RSigma is a CLI tool that converts SigmaHQ detection rules (3,800+ community rules) into native PostgreSQL SQL queries for use with TimescaleDB. The post walks through ingesting Okta audit logs via Helr, storing them in a hypertable using either a pure JSONB schema or a hybrid column/JSONB approach, and then running rsigma convert to generate SELECT statements, views, time-bucketed queries, and continuous aggregates. It demonstrates correlation queries for the Okta cross-tenant impersonation attack chain, shows how pg_cron enables near-real-time detection, and explains how Grafana can close the alerting loop. Tradeoffs versus a dedicated SIEM are discussed, including single-node limitations and the unsuitability of continuous aggregates for complex CTEs.
