First release. (v0.1.0 and v0.1.1 are retracted; use this version or later.)
- Sigma frontend covering a documented subset (SUBSET.md): full condition grammar, 14 field modifiers, keyword search, multi-document files. Constructs outside the subset get an explicit unsupported verdict naming the construct. 99.7% of a 2026-07-08 SigmaHQ clone (3,131 of 3,140 rules) parses under it.
- Matching engine cross-checked against Chainsaw: every one of its 712 matches reproduced over 3,241 real EVTX events (docs/eval-differential.md).
- deps: per-rule and corpus-wide field dependency footprints.
- check: dead field references, case mismatches and type mismatches against a declared detsema-schema/v1 field inventory. Reports name the inventory they trusted.
- schema: load JSON/YAML inventories, infer one from NDJSON event samples, or import ECS.
- Output: text, JSONL, SARIF 2.1.0. Exit codes: 0 clean, 1 findings, 2 error.
Sigma is the only dialect in this release. detsema runs offline and makes no network connections at runtime.