Sigma

What it is

An open, structured way to describe suspicious log events in YAML so that one rule can convert into queries for many different monitoring systems.

What it helps with

- Writing a detection once and converting it to several query languages
- Sharing community reviewed rules for threats, hunting, and compliance
- Keeping detection logic readable and tied to no single platform

Who it's for

Detection engineers, threat hunters, and SOC analysts who build and share log-based detections.

Worth knowing

Rules are converted with the separate sigma-cli and pySigma tooling. The rule set uses the Detection Rule License, which is permissive but not OSI approved, while the specification is public domain.

Are there rules for brand-new threats?
Yes. Emerging threat rules target specific campaigns and recently exploited vulnerabilities.

Is the format itself versioned?
Yes. The specification is maintained separately and carries its own version number.

How often do new rules land?
New rule packages are published on a regular schedule.