Sigma
Generic signature format for describing log detection rules, enabling portable threat detections across different SIEMs.
Technical Architecture & Overview
Sigma provides a standardized YAML rule format for describing log events and attack patterns. Using converter tools like pySigma, defenders write detection rules once and compile them into queries for Elasticsearch, Splunk, Microsoft Sentinel, SQLite/SQL-based backends, and other SIEM targets. The Detection Rule License (DRL-1.1) is SPDX-listed but not OSI-approved, so the project is classified as Free rather than Open Source.
Targeted Technical Use Cases
Authoring portable detection rules, sharing threat intelligence signatures, and avoiding vendor lock-in across SIEM backends.
Evaluation & Trade-offs
Core Strengths
- +Vendor-agnostic rule format supported by the detection engineering community.
- +Large public repository of verified rules mapped to MITRE ATT&CK techniques.
- +pySigma backend ecosystem simplifies conversion into production query languages.
Trade-Offs & Limitations
- -Log schema differences between target systems require custom field mapping files.
- -Complex multi-event correlation can be difficult to express in basic rule definitions.
Defensive Security Application
Standardizing threat detection logic and quickly deploying rules for newly disclosed attack vectors.
Frequently Asked Questions
What is Sigma?→
Sigma provides a standardized YAML rule format for describing log events and attack patterns. Using converter tools like pySigma, defenders write detection rules once and compile them into queries for Elasticsearch, Splunk, Microsoft Sentinel, SQLite/SQL-based backends, and other SIEM targets. The Detection Rule License (DRL-1.1) is SPDX-listed but not OSI-approved, so the project is classified as Free rather than Open Source.
What is Sigma used for?→
Authoring portable detection rules, sharing threat intelligence signatures, and avoiding vendor lock-in across SIEM backends.
What are the strengths of Sigma?→
- +Vendor-agnostic rule format supported by the detection engineering community.
- +Large public repository of verified rules mapped to MITRE ATT&CK techniques.
- +pySigma backend ecosystem simplifies conversion into production query languages.
What are the limitations of Sigma?→
- +Log schema differences between target systems require custom field mapping files.
- +Complex multi-event correlation can be difficult to express in basic rule definitions.
How is Sigma used defensively?→
Standardizing threat detection logic and quickly deploying rules for newly disclosed attack vectors.