Fix pySigma RE2 compatibility in fresh installations

README.md

@@ -31,6 +31,25 @@ netscaler-triage .\logs.7z
 
 Installation may require internet access. Analysis runs offline.
 
+### Update an existing installation
+
+Activate the same virtual environment used to run the tool, then run from the
+repository directory:
+
+```sh
+git pull
+python -m pip install --upgrade .
+netscaler-triage rules
+```
+
+For an environment managed by uv, use `uv sync --locked` after `git pull`.
+Version 1.0.1 fixes installation failures reporting `invalid perl operator: (?=`
+or `SigmaRegularExpressionError` when loading the bundled rules. pySigma 2 changed
+its default validation engine to RE2, which rejects lookaheads. The package now
+requires compatible pySigma 1.x; detection patterns and timed matching are
+unchanged. Reinstalling with the command above also downgrades an incompatible
+pySigma installation. Rerun any scan that stopped with this error.
+
 ## Everyday use
 
 ```sh