pySigma: the Python library that converts Sigma rules into queries

pySigma (about 600 stars on GitHub) is the reference implementation of the Sigma detection rule format as a Python library. It was started in 2021 by Thomas Patzke, one of the two creators of Sigma, as a clean replacement for the original sigmac converter, and it is maintained by the SigmaHQ organisation alongside the rule library described in the encyclopedia entry Sigma: the open detection-rule format for log data. The sigma-cli command line tool is a thin wrapper around it, and several vendors embed the library in their own products.

What it does

A Sigma rule says what to look for in a vendor neutral way; pySigma turns that description into something a real log system can execute. The library has three layers. The core parses rules into Python objects and validates them. Processing pipelines describe how field names and log sources differ in a given environment, for example that a Windows event field is called one thing in Elastic and another in Splunk, and transform the rule accordingly. Backends, each in its own plugin package, generate the final query language: there are backends for Splunk, Elasticsearch and OpenSearch, Microsoft Sentinel and Defender, Grafana Loki, QRadar, CrowdStrike, SQLite and many more. Backends live in separate repositories under SigmaHQ and in third party organisations, and a plugin directory inside pySigma lets sigma-cli find and install them.

Who it is for

• Detection engineers who maintain rules in Sigma and want them deployed automatically to whatever SIEM the organisation runs.
• Developers of log platforms who want to offer Sigma support and only need to write a backend.
• Teams building continuous integration for detection content, since the library can validate every rule in a repository on each commit.
• Anyone writing scripts that need to inspect or rewrite Sigma rules programmatically.

How to install it

The library is on PyPI as pysigma, and backends as pysigma-backend-NAME. Most people use it through sigma-cli, which installs the library as a dependency and manages plugins:

pipx install sigma-cli
sigma plugin install elasticsearch
sigma version

The documentation explains the rule model, how to write a pipeline for your own field names and how to build a backend. The encyclopedia how-to Try Sigma rules against your own logs shows the conversion end to end.

Credit

pySigma is written and maintained by Thomas Patzke with the SigmaHQ team and backend authors from the community. It is released under the GNU Lesser General Public License version 2.1, which allows it to be used inside commercial products.