I maintain a small python tool called SIEMForge. it builds and converts SIEM detection content, Sigma rules plus a Sysmon config plus Wazuh rules, and it ships a log scanner so you can test a rule against a raw log file before you push it to a real SIEM.
a while back i added a size cap to the scanner. every parse path reads the whole file into memory, so a 5GB syslog or some attacker-supplied json blob would eat all the RAM the process can grab before matching even starts. the cap is 100MB by default, overridable with an env var. boring, and exactly the kind of thing you add once and forget.
last week i was reading the coverage report properly instead of skimming the total, and the size guard had a branch nothing tested. here's the whole function:
def _check_log_size(path: Path) -> None:
limit = _resolve_max_bytes()
