Detection as Code

Google Security Operations vs Sigma and pySigma

Google Security Operations totals 6.83 and Sigma and pySigma totals 5.50 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Google Security Operations leads by 1.33 points. The pair turns on rule health: Google Security Operations documents it in full, and Sigma and pySigma publish nothing on it. Neither documents field drift alerts tied to rules.

The difference that decides this pair

The largest weighted gap on the rubric is rule health: Google Security Operations scores 8.0 against 2.0 for Sigma and pySigma, which is 1.08 of the 10 point total.

The pair splits on rule health: Google Security Operations shows rule errors, latency metrics and rule quotas on a Rule Observability dashboard, and Sigma and pySigma are a rule format and converter with no runtime, so there is no health signal to document. docs.cloud.google.com read 2026-11-03 github.com read 2026-11-03

Rubric side by side

Google Security Operations totals 6.83 and Sigma and pySigma totals 5.50 out of 10.

Rubric criteria for Google Security Operations and Sigma and pySigma, scores out of 10. A plus marks a criterion where Sigma and pySigma scores higher, a minus where Google Security Operations does.

MarkerCriterionWeightGoogle Security OperationsSigma and pySigma
+Rule languages and conversion paths157.08.5
-Git-native workflow and CI/CD188.06.0
-Testing158.04.0
+Coverage analytics124.05.0
-Rule health188.02.0
-Versioning and rollback88.05.0
+Content library size and freshness85.08.0
+Pricing transparency63.09.0
Total1006.835.50

The 33 capabilities as a diff

Read it as a diff from Google Security Operations to Sigma and pySigma: 22 of 33 rows differ. A plus marks a row where Sigma and pySigma documents more (8 rows), a minus a row where Google Security Operations documents more (14 rows). Rows with no marker match.

Capability rows for Google Security Operations and Sigma and pySigma, grouped. Changed rows are shaded and carry a marker.

MarkerCapabilityGoogle Security OperationsSigma and pySigma
Languages
Sigma and pySigma documents moreSigma nativeGoogle Security Operations, Sigma native: not documentednot documentedSigma and pySigma, Sigma native: documenteddocumented
Sigma and pySigma documents moreSigma conversionGoogle Security Operations, Sigma conversion: not documentednot documentedSigma and pySigma, Sigma conversion: documenteddocumented
Google Security Operations documents moreYARA-LGoogle Security Operations, YARA-L: documenteddocumentedSigma and pySigma, YARA-L: partialpartial
Sigma and pySigma documents moreSPLGoogle Security Operations, SPL: not documentednot documentedSigma and pySigma, SPL: documenteddocumented
Sigma and pySigma documents moreKQLGoogle Security Operations, KQL: not documentednot documentedSigma and pySigma, KQL: documenteddocumented
Sigma and pySigma documents moreEQL or ES|QLGoogle Security Operations, EQL or ES|QL: not documentednot documentedSigma and pySigma, EQL or ES|QL: documenteddocumented
PythonGoogle Security Operations, Python: not documentednot documentedSigma and pySigma, Python: not documentednot documented
Visual builderGoogle Security Operations, Visual builder: not documentednot documentedSigma and pySigma, Visual builder: not documentednot documented
YARAGoogle Security Operations, YARA: not documentednot documentedSigma and pySigma, YARA: not documentednot documented
Sigma and pySigma documents moreLucene or KQL-likeGoogle Security Operations, Lucene or KQL-like: not documentednot documentedSigma and pySigma, Lucene or KQL-like: documenteddocumented
Source control and CI
Google Security Operations documents moreGit syncGoogle Security Operations, Git sync: documenteddocumentedSigma and pySigma, Git sync: not documentednot documented
Google Security Operations documents morePR deployGoogle Security Operations, PR deploy: partialpartialSigma and pySigma, PR deploy: not documentednot documented
Google Security Operations documents moreCLIGoogle Security Operations, CLI: documenteddocumentedSigma and pySigma, CLI: partialpartial
Google Security Operations documents moreRule APIGoogle Security Operations, Rule API: documenteddocumentedSigma and pySigma, Rule API: not documentednot documented
Sigma and pySigma documents moreCI examplesGoogle Security Operations, CI examples: not documentednot documentedSigma and pySigma, CI examples: partialpartial
Env promotionGoogle Security Operations, Env promotion: not documentednot documentedSigma and pySigma, Env promotion: not documentednot documented
Testing
Unit testsGoogle Security Operations, Unit tests: not documentednot documentedSigma and pySigma, Unit tests: not documentednot documented
Google Security Operations documents moreReplayGoogle Security Operations, Replay: documenteddocumentedSigma and pySigma, Replay: not documentednot documented
Google Security Operations documents moreSynthetic eventsGoogle Security Operations, Synthetic events: partialpartialSigma and pySigma, Synthetic events: not documentednot documented
Google Security Operations documents moreBacktest reportsGoogle Security Operations, Backtest reports: partialpartialSigma and pySigma, Backtest reports: not documentednot documented
Test coverageGoogle Security Operations, Test coverage: not documentednot documentedSigma and pySigma, Test coverage: not documentednot documented
Coverage analytics
ATT&CK mapGoogle Security Operations, ATT&CK map: documenteddocumentedSigma and pySigma, ATT&CK map: documenteddocumented
Google Security Operations documents moreGap viewGoogle Security Operations, Gap view: documenteddocumentedSigma and pySigma, Gap view: not documentednot documented
Google Security Operations documents moreData sourcesGoogle Security Operations, Data sources: partialpartialSigma and pySigma, Data sources: not documentednot documented
Google Security Operations documents moreLog source healthGoogle Security Operations, Log source health: partialpartialSigma and pySigma, Log source health: not documentednot documented
Rule health
Google Security Operations documents moreNoisy rulesGoogle Security Operations, Noisy rules: partialpartialSigma and pySigma, Noisy rules: not documentednot documented
Google Security Operations documents moreBroken rulesGoogle Security Operations, Broken rules: documenteddocumentedSigma and pySigma, Broken rules: not documentednot documented
Field driftGoogle Security Operations, Field drift: not documentednot documentedSigma and pySigma, Field drift: not documentednot documented
Google Security Operations documents moreRule costGoogle Security Operations, Rule cost: documenteddocumentedSigma and pySigma, Rule cost: not documentednot documented
LifecycleGoogle Security Operations, Lifecycle: documenteddocumentedSigma and pySigma, Lifecycle: documenteddocumented
Library
Sigma and pySigma documents moreLibrary countGoogle Security Operations, Library count: partialpartialSigma and pySigma, Library count: documenteddocumented
CommunityGoogle Security Operations, Community: documenteddocumentedSigma and pySigma, Community: documenteddocumented
CadenceGoogle Security Operations, Cadence: partialpartialSigma and pySigma, Cadence: partialpartial

documenteddocumentedpartialpartialnot documentednot documented

Sources for the rows that differ

Verdict by buyer type

Which of the two fits each kind of team.

BuyerVerdict
Microsoft Sentinel estateSigma and pySigma is the better fit: they convert Sigma to KQL through its Kusto backend, listed as Stable; Google Security Operations documents no Sentinel path.
Elastic estateSigma and pySigma is the better fit: they convert Sigma to Lucene, ES|QL and EQL through its Elasticsearch backend; Google Security Operations documents no Elastic path.
Splunk estateSigma and pySigma is the better fit: they convert Sigma to SPL through its Splunk backend; Google Security Operations documents no Splunk path.
Google SecOps estateGoogle Security Operations is the better fit: it runs the estate natively, with YARA-L rules, a Rules API and a Content Manager CLI; Sigma and pySigma have a Google SecOps backend that its backend list marks as Development.
a team starting from scratch with SigmaSigma and pySigma is the better fit: they are the format itself and converts it to Splunk, Kusto and Elasticsearch targets, with no runtime, tests or health checks; Google Security Operations documents YARA-L and no Sigma path.

When to pick each

Google Security Operations: Pick Google Security Operations when testing is the deciding need: it tests a rule over a time range, retrohunts against historical data and offers event simulation (pre-GA). It also leads on CI and deployment.

Sigma and pySigma: Pick Sigma and pySigma when rule languages is the deciding need: they convert one rule to Splunk, Kusto and Elasticsearch (Lucene, ES|QL, EQL) backends through installable plugins. They also lead on library size.

Profiles: Google Security Operations, Sigma and pySigma. Alternatives: to Google Security Operations, to Sigma and pySigma.