Hunters vs Sigma and pySigma
Hunters totals 3.44 and Sigma and pySigma totals 5.50 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Sigma and pySigma lead by 2.06 points. The pair turns on rule languages: Sigma and pySigma document it in full, and Hunters publishes nothing on it. Neither documents field drift alerts tied to rules.
The difference that decides this pair
The largest weighted gap on the rubric is rule languages and conversion paths: Sigma and pySigma scores 8.5 against 3.0 for Hunters, which is 0.82 of the 10 point total.
For rule languages, Sigma and pySigma convert one rule to Splunk, Kusto and Elasticsearch (Lucene, ES|QL, EQL) backends through installable plugins, whereas Hunters names no rule language and normalises data to OCSF. sigmahq.io read 2026-11-03 hunters.security read 2026-11-04
Rubric side by side
Hunters totals 3.44 and Sigma and pySigma totals 5.50 out of 10.
Rubric criteria for Hunters and Sigma and pySigma, scores out of 10. A plus marks a criterion where Sigma and pySigma scores higher, a minus where Hunters does.
| Marker | Criterion | Weight | Hunters | Sigma and pySigma |
|---|---|---|---|---|
| + | Rule languages and conversion paths | 15 | 3.0 | 8.5 |
| + | Git-native workflow and CI/CD | 18 | 3.0 | 6.0 |
| Testing | 15 | 4.0 | 4.0 | |
| + | Coverage analytics | 12 | 4.0 | 5.0 |
| - | Rule health | 18 | 3.5 | 2.0 |
| + | Versioning and rollback | 8 | 3.0 | 5.0 |
| + | Content library size and freshness | 8 | 4.0 | 8.0 |
| + | Pricing transparency | 6 | 3.0 | 9.0 |
| Total | 100 | 3.44 | 5.50 |
The 33 capabilities as a diff
Read it as a diff from Hunters to Sigma and pySigma: 18 of 33 rows differ. A plus marks a row where Sigma and pySigma documents more (12 rows), a minus a row where Hunters documents more (6 rows). Rows with no marker match.
Capability rows for Hunters and Sigma and pySigma, grouped. Changed rows are shaded and carry a marker.
| Marker | Capability | Hunters | Sigma and pySigma |
|---|---|---|---|
| Languages | |||
| Sigma and pySigma documents more | Sigma native | not documented | documented |
| Sigma and pySigma documents more | Sigma conversion | not documented | documented |
| Sigma and pySigma documents more | YARA-L | not documented | partial |
| Sigma and pySigma documents more | SPL | not documented | documented |
| Sigma and pySigma documents more | KQL | not documented | documented |
| Sigma and pySigma documents more | EQL or ES|QL | not documented | documented |
| Python | not documented | not documented | |
| Hunters documents more | Visual builder | partial | not documented |
| YARA | not documented | not documented | |
| Sigma and pySigma documents more | Lucene or KQL-like | not documented | documented |
| Source control and CI | |||
| Git sync | not documented | not documented | |
| PR deploy | not documented | not documented | |
| Sigma and pySigma documents more | CLI | not documented | partial |
| Rule API | not documented | not documented | |
| Sigma and pySigma documents more | CI examples | not documented | partial |
| Env promotion | not documented | not documented | |
| Testing | |||
| Unit tests | not documented | not documented | |
| Hunters documents more | Replay | documented | not documented |
| Synthetic events | not documented | not documented | |
| Backtest reports | not documented | not documented | |
| Test coverage | not documented | not documented | |
| Coverage analytics | |||
| ATT&CK map | documented | documented | |
| Hunters documents more | Gap view | documented | not documented |
| Hunters documents more | Data sources | partial | not documented |
| Hunters documents more | Log source health | partial | not documented |
| Rule health | |||
| Hunters documents more | Noisy rules | partial | not documented |
| Broken rules | not documented | not documented | |
| Field drift | not documented | not documented | |
| Rule cost | not documented | not documented | |
| Sigma and pySigma documents more | Lifecycle | partial | documented |
| Library | |||
| Sigma and pySigma documents more | Library count | partial | documented |
| Sigma and pySigma documents more | Community | not documented | documented |
| Cadence | partial | partial | |
documentedpartialnot documented
Sources for the rows that differ
- Sigma native (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Sigma rule format and 'Sigma Rules Specification', including 'Correlations' sigmahq.io read 2026-11-03.
- Sigma conversion (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, pySigma 'Converting Sigma Rules into Queries'; sigma-cli 'sigma convert -t splunk' sigmahq-pysigma.readthedocs.io read 2026-11-03.
- YARA-L (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: partial, Google SecOps backend converts to 'UDM searches and YARA-L 2.0 detection rules'; listed with status Development sigmahq.io read 2026-11-03.
- SPL (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Splunk backend listed under Backends sigmahq.io read 2026-11-03.
- KQL (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, 'Kusto' backend: Kusto Query Language (KQL) backend, status Stable sigmahq.io read 2026-11-03.
- EQL or ES|QL (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Elasticsearch backend converts to 'Lucene, ES|QL (with correlations) and EQL queries' sigmahq.io read 2026-11-03.
- Visual builder (Hunters documents more). Hunters: partial, 'Create a custom detector': guided Filter and Group By detector modes with 'Test logic'; not described as no-code docs.hunters.ai read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Lucene or KQL-like (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Elasticsearch backend outputs Lucene queries sigmahq.io read 2026-11-03.
- CLI (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: partial, sigma-cli: convert, list, plugin install; pySigma 'Validating Sigma Rules'; no deploy step sigmahq-pysigma.readthedocs.io read 2026-11-03.
- CI examples (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: partial, Sigma repo's own GitHub Actions 'Sigma Rule Tests' (yamllint, logsource tests); not a deploy pipeline raw.githubusercontent.com read 2026-11-03.
- Replay (Hunters documents more). Hunters: documented, 'Test logic': choose a timeframe and view samples of events that would generate leads docs.hunters.ai read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Gap view (Hunters documents more). Hunters: documented, Threat Coverage map: gray technique means 'currently not covered' docs.hunters.ai read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Data sources (Hunters documents more). Hunters: partial, Detector list shows data sources per detector; gray cells can reflect missing telemetry docs.hunters.ai read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Log source health (Hunters documents more). Hunters: partial, 'About data health' monitors each data flow; not tied to detectors docs.hunters.ai read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Noisy rules (Hunters documents more). Hunters: partial, Detectors page shows leads, alerts and clusters per detector and alert enablement overrides docs.hunters.ai read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Lifecycle (Sigma and pySigma documents more). Hunters: partial, Detectors page lists detector 'status' and alert enabled settings; no deprecation states docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Rule 'status': stable, test, experimental, deprecated, unsupported raw.githubusercontent.com read 2026-11-03.
- Library count (Sigma and pySigma documents more). Hunters: partial, 'a library of hundreds of detectors'; no number docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Main repo 'offers more than 3000 detection rules' (SigmaHQ is not a vendor; counted as the maintained library) raw.githubusercontent.com read 2026-11-03.
- Community (Sigma and pySigma documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sigma and pySigma: documented, Community-maintained repo with contribution guide and rule types raw.githubusercontent.com read 2026-11-03.
Verdict by buyer type
Which of the two fits each kind of team.
| Buyer | Verdict |
|---|---|
| Microsoft Sentinel estate | Sigma and pySigma is the better fit: they convert Sigma to KQL through its Kusto backend, listed as Stable; Hunters documents no Sentinel path. |
| Elastic estate | Sigma and pySigma is the better fit: they convert Sigma to Lucene, ES|QL and EQL through its Elasticsearch backend; Hunters documents no Elastic path. |
| Splunk estate | Sigma and pySigma is the better fit: they convert Sigma to SPL through its Splunk backend; Hunters documents no Splunk path. |
| Google SecOps estate | Sigma and pySigma is the only one of the pair with any stated route: they have a Google SecOps backend that its backend list marks as Development; Hunters documents no Google SecOps path. |
| a team starting from scratch with Sigma | Sigma and pySigma is the better fit: they are the format itself and converts it to Splunk, Kusto and Elasticsearch targets, with no runtime, tests or health checks; Hunters documents no Sigma path. |
When to pick each
Hunters: Pick Hunters when rule health is the deciding need: it shows leads, alerts and clusters per detector and offers a Test logic step on a custom detector over a chosen timeframe. Sigma and pySigma have no runtime and score lower on rule health.
Sigma and pySigma: Pick Sigma and pySigma when CI and deployment is the deciding need: they convert rules from the command line with sigma-cli and has no deploy step. They also lead on rule languages.
Profiles: Hunters, Sigma and pySigma. Alternatives: to Hunters, to Sigma and pySigma.