Sigma: the open detection-rule format for log data

Sigma (about 11,000 stars on GitHub) is often described as “the YARA of log files” or “Snort for logs”: a generic, open signature format for describing suspicious activity in log data. The project was started in 2017 by Florian Roth and Thomas Patzke and is now run by the SigmaHQ organisation with a core maintainer team and several hundred contributors. The repository contains the rule specification, a library of more than three thousand community rules organised by log source (Windows, Linux, macOS, cloud providers, network devices, web servers and applications), and documentation on how rules are written and reviewed.

What a Sigma rule is

A Sigma rule is a short YAML file that describes one pattern of interest in a vendor-neutral way: which kind of log it applies to, what values or combinations of values make an event suspicious, and how severe a hit is. The rule itself is never run directly. A separate converter reads it and produces an equivalent query in the language of the tool you actually use, so one rule written once can become a Splunk search, an Elasticsearch or Kibana query, a Microsoft Sentinel KQL statement, a Grafana Loki LogQL query or an entry for many other backends. That separation is the whole point: detections become shareable text that any team can read, review in version control and adopt without being tied to a product.

Who it is for

• Security operations centre (SOC) teams and detection engineers who want a common format for their own rules and a large starting library.
• Administrators who run a log platform such as Loki or Elastic and want to add detection on top of existing monitoring.
• Vendors and open source projects that implement Sigma support in their products; dozens already do.
• Students and researchers studying how attacks appear in logs, since each rule links to references and MITRE ATT&CK tags.

How to browse and install it

Rules can be read directly on GitHub under the rules/ tree and its siblings for emerging threats and threat hunting, or searched on the companion site sigmasearchengine.com. The converter lives in a separate repository, SigmaHQ/sigma-cli, built on the pySigma library, and installs from PyPI; backends for individual tools are installed as plugins:

pipx install sigma-cli
sigma plugin list
sigma plugin install loki
git clone --depth 1 https://github.com/SigmaHQ/sigma.git

The how-to Try Sigma rules against your own logs walks through a first conversion. The older sigmac tool and the original sigmatools package are deprecated; new work should use sigma-cli and pySigma.

Credit

Sigma was created by Florian Roth and Thomas Patzke and is maintained by the SigmaHQ team and community. The rules in the repository are published under the Detection Rule License (DRL) 1.1, a permissive licence written for detection content; the tooling in the related repositories is under the LGPL. See the LICENSE files in each repository for the exact terms.