Sigma
Generic signature format for describing log detection rules, enabling portable threat detections across different SIEMs.
Technical Architecture & Overview
Sigma provides a standardized YAML rule format for describing log events and attack patterns. Using converter tools like pySigma, defenders write detection rules once and compile them into queries for Elasticsearch, Splunk, Microsoft Sentinel, SQLite/SQL-based backends, and other SIEM targets. The Detection Rule License (DRL-1.1) is SPDX-listed but not OSI-approved, so the project is classified as Free rather than Open Source.
Targeted Technical Use Cases
Authoring portable detection rules, sharing threat intelligence signatures, and avoiding vendor lock-in across SIEM backends.
Evaluation & Trade-offs
Core Strengths
- +Vendor-agnostic rule format supported by the detection engineering community.
- +Public repository of more than 3,000 community peer-reviewed rules, which can be tagged with MITRE ATT&CK techniques.
- +pySigma backend ecosystem simplifies conversion into production query languages.
Trade-Offs & Limitations
- -Log schema differences between target systems require custom field mapping files.
- -Multi-event correlation uses separate correlation rules, which only some backends support (Splunk SPL, Elasticsearch ES|QL, Grafana Loki, SQL, and OpenSearch).
Defensive Security Application
Standardizing threat detection logic and quickly deploying rules for newly disclosed attack vectors.
Frequently Asked Questions
What is Sigma?→
Sigma provides a standardized YAML rule format for describing log events and attack patterns. Using converter tools like pySigma, defenders write detection rules once and compile them into queries for Elasticsearch, Splunk, Microsoft Sentinel, SQLite/SQL-based backends, and other SIEM targets. The Detection Rule License (DRL-1.1) is SPDX-listed but not OSI-approved, so the project is classified as Free rather than Open Source.
What is Sigma used for?→
Authoring portable detection rules, sharing threat intelligence signatures, and avoiding vendor lock-in across SIEM backends.
What are the strengths of Sigma?→
- +Vendor-agnostic rule format supported by the detection engineering community.
- +Public repository of more than 3,000 community peer-reviewed rules, which can be tagged with MITRE ATT&CK techniques.
- +pySigma backend ecosystem simplifies conversion into production query languages.
What are the limitations of Sigma?→
- +Log schema differences between target systems require custom field mapping files.
- +Multi-event correlation uses separate correlation rules, which only some backends support (Splunk SPL, Elasticsearch ES|QL, Grafana Loki, SQL, and OpenSearch).
How is Sigma used defensively?→
Standardizing threat detection logic and quickly deploying rules for newly disclosed attack vectors.