--- title: "Security Observability with RSigma and the LGTM Stack" url: https://daily.dev/posts/security-observability-with-rsigma-and-the-lgtm-stack-qf0dc2lbr source_url: https://itnext.io/security-observability-with-rsigma-and-the-lgtm-stack-375ccd260795 type: article source: "ITNEXT" published: 2026-06-23T11:16:23.541Z updated: 2026-06-23T11:16:56.934Z tags: ["grafana", "opentelemetry", "prometheus"] reading_time: 17 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Security Observability with RSigma and the LGTM Stack **[ITNEXT](https://daily.dev/sources/itnext)** · 17 min read · 0 upvotes · 0 comments ## Summary RSigma v0.9.0 can be wired into a full detection-to-alert pipeline using the Grafana LGTM stack (Loki, Grafana, Mimir) with Alloy as the OpenTelemetry collector. The setup uses Docker Compose with seven components: Helr replays pre-recorded Okta audit events, Alloy fans logs to both RSigma (for real-time Sigma rule evaluation) and Loki (for storage), and RSigma exposes per-rule Prometheus metrics with rule_title and level labels. Grafana alert rules use Go templates to dynamically map Sigma severity levels (critical/high/medium/low) to P1-P4 priorities, enabling automatic alert routing without manual wiring. The Okta cross-tenant impersonation scenario demonstrates the full chain: four ordered detections trigger a temporal_ordered correlation, producing a critical alert that routes to the appropriate notification channel. The entire alerting configuration is version-controlled and provisioned automatically. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Building a Detection Layer on PostgreSQL with Sigma Rules](https://daily.dev/posts/building-a-detection-layer-on-postgresql-with-sigma-rules-g9rkyvinz) · ITNEXT · 0 upvotes · 0 comments - [Streaming Logs to RSigma for Real-Time Detection](https://daily.dev/posts/streaming-logs-to-rsigma-for-real-time-detection-sy1o5zzoa) · ITNEXT · 0 upvotes · 0 comments - [The State of RSigma](https://daily.dev/posts/the-state-of-rsigma-wf2clyaau) · ITNEXT · 21 upvotes · 1 comments --- Tags: [#grafana](https://daily.dev/tags/grafana), [#opentelemetry](https://daily.dev/tags/opentelemetry), [#prometheus](https://daily.dev/tags/prometheus) [View this post on daily.dev](https://daily.dev/posts/security-observability-with-rsigma-and-the-lgtm-stack-qf0dc2lbr)