RSigma v0.9.0 can be wired into a full detection-to-alert pipeline using the Grafana LGTM stack (Loki, Grafana, Mimir) with Alloy as the OpenTelemetry collector. The setup uses Docker Compose with seven components: Helr replays pre-recorded Okta audit events, Alloy fans logs to both RSigma (for real-time Sigma rule evaluation) and Loki (for storage), and RSigma exposes per-rule Prometheus metrics with rule_title and level labels. Grafana alert rules use Go templates to dynamically map Sigma severity levels (critical/high/medium/low) to P1-P4 priorities, enabling automatic alert routing without manual wiring. The Okta cross-tenant impersonation scenario demonstrates the full chain: four ordered detections trigger a temporal_ordered correlation, producing a critical alert that routes to the appropriate notification channel. The entire alerting configuration is version-controlled and provisioned automatically.
