Sekoia.io vs Sigma and pySigma
Sekoia totals 3.46 and Sigma and pySigma totals 5.50 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Sigma and pySigma lead by 2.04 points. The pair turns on rule health: Sekoia describes it only in part, or as a vendor claim, and Sigma and pySigma publish nothing on it. Neither documents field drift alerts tied to rules.
The difference that decides this pair
The largest weighted gap on the rubric is rule languages and conversion paths: Sigma and pySigma scores 8.5 against 4.0 for Sekoia.io, which is 0.68 of the 10 point total.
Sigma and pySigma are a rule format and converter with no runtime, so there is no health signal to document; Sekoia, by contrast, groups repeat matches with alert similarity and documents no failed-rule alert. docs.sekoia.com read 2026-11-03 github.com read 2026-11-03
Rubric side by side
Sekoia.io totals 3.46 and Sigma and pySigma totals 5.50 out of 10.
Rubric criteria for Sekoia.io and Sigma and pySigma, scores out of 10. A plus marks a criterion where Sigma and pySigma scores higher, a minus where Sekoia.io does.
| Marker | Criterion | Weight | Sekoia.io | Sigma and pySigma |
|---|---|---|---|---|
| + | Rule languages and conversion paths | 15 | 4.0 | 8.5 |
| + | Git-native workflow and CI/CD | 18 | 3.5 | 6.0 |
| + | Testing | 15 | 3.5 | 4.0 |
| + | Coverage analytics | 12 | 3.5 | 5.0 |
| - | Rule health | 18 | 3.0 | 2.0 |
| + | Versioning and rollback | 8 | 3.0 | 5.0 |
| + | Content library size and freshness | 8 | 4.0 | 8.0 |
| + | Pricing transparency | 6 | 3.0 | 9.0 |
| Total | 100 | 3.46 | 5.50 |
The 33 capabilities as a diff
Read it as a diff from Sekoia.io to Sigma and pySigma: 19 of 33 rows differ. A plus marks a row where Sigma and pySigma documents more (9 rows), a minus a row where Sekoia.io documents more (10 rows). Rows with no marker match.
Capability rows for Sekoia.io and Sigma and pySigma, grouped. Changed rows are shaded and carry a marker.
| Marker | Capability | Sekoia.io | Sigma and pySigma |
|---|---|---|---|
| Languages | |||
| Sigma native | documented | documented | |
| Sigma and pySigma documents more | Sigma conversion | not documented | documented |
| Sigma and pySigma documents more | YARA-L | not documented | partial |
| Sigma and pySigma documents more | SPL | not documented | documented |
| Sigma and pySigma documents more | KQL | not documented | documented |
| Sigma and pySigma documents more | EQL or ES|QL | not documented | documented |
| Python | not documented | not documented | |
| Visual builder | not documented | not documented | |
| YARA | not documented | not documented | |
| Sigma and pySigma documents more | Lucene or KQL-like | partial | documented |
| Source control and CI | |||
| Git sync | not documented | not documented | |
| PR deploy | not documented | not documented | |
| Sigma and pySigma documents more | CLI | not documented | partial |
| Sekoia.io documents more | Rule API | documented | not documented |
| Sigma and pySigma documents more | CI examples | not documented | partial |
| Env promotion | not documented | not documented | |
| Testing | |||
| Sekoia.io documents more | Unit tests | partial | not documented |
| Sekoia.io documents more | Replay | documented | not documented |
| Synthetic events | not documented | not documented | |
| Sekoia.io documents more | Backtest reports | partial | not documented |
| Test coverage | not documented | not documented | |
| Coverage analytics | |||
| ATT&CK map | documented | documented | |
| Sekoia.io documents more | Gap view | partial | not documented |
| Sekoia.io documents more | Data sources | partial | not documented |
| Sekoia.io documents more | Log source health | partial | not documented |
| Rule health | |||
| Sekoia.io documents more | Noisy rules | partial | not documented |
| Sekoia.io documents more | Broken rules | partial | not documented |
| Field drift | not documented | not documented | |
| Sekoia.io documents more | Rule cost | partial | not documented |
| Lifecycle | documented | documented | |
| Library | |||
| Library count | documented | documented | |
| Sigma and pySigma documents more | Community | not documented | documented |
| Cadence | partial | partial | |
documentedpartialnot documented
Sources for the rows that differ
- Sigma conversion (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: documented, pySigma 'Converting Sigma Rules into Queries'; sigma-cli 'sigma convert -t splunk' sigmahq-pysigma.readthedocs.io read 2026-11-03.
- YARA-L (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: partial, Google SecOps backend converts to 'UDM searches and YARA-L 2.0 detection rules'; listed with status Development sigmahq.io read 2026-11-03.
- SPL (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: documented, Splunk backend listed under Backends sigmahq.io read 2026-11-03.
- KQL (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: documented, 'Kusto' backend: Kusto Query Language (KQL) backend, status Stable sigmahq.io read 2026-11-03.
- EQL or ES|QL (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: documented, Elasticsearch backend converts to 'Lucene, ES|QL (with correlations) and EQL queries' sigmahq.io read 2026-11-03.
- Lucene or KQL-like (Sigma and pySigma documents more). Sekoia.io: partial, 'SOL' (Sekoia Operating Language) queries run as scheduled detection rules; syntax relation to KQL not stated docs.sekoia.com read 2026-11-03. Sigma and pySigma: documented, Elasticsearch backend outputs Lucene queries sigmahq.io read 2026-11-03.
- CLI (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: partial, sigma-cli: convert, list, plugin install; pySigma 'Validating Sigma Rules'; no deploy step sigmahq-pysigma.readthedocs.io read 2026-11-03.
- Rule API (Sekoia.io documents more). Sekoia.io: documented, 'Create a SIGMA rule' tutorial: POST /v1/sic/conf/rules-catalog/rules; search rules tutorial docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- CI examples (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: partial, Sigma repo's own GitHub Actions 'Sigma Rule Tests' (yamllint, logsource tests); not a deploy pipeline raw.githubusercontent.com read 2026-11-03.
- Unit tests (Sekoia.io documents more). Sekoia.io: partial, 'Rule testing' with 'Test pattern' on historical data; no sample-event test cases docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Replay (Sekoia.io documents more). Sekoia.io: documented, 'Rule testing': evaluate a Sigma pattern against historical data docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Backtest reports (Sekoia.io documents more). Sekoia.io: partial, 'Test results visualization' shows detection frequency and event distribution; not saved as a report docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Gap view (Sekoia.io documents more). Sekoia.io: partial, Matrix cells colored by rule count; gaps are inferred from empty cells, no gap report named docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Data sources (Sekoia.io documents more). Sekoia.io: partial, Rules list 'Compatible intake formats'; 'Asset connector health status' (Reveal module) docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Log source health (Sekoia.io documents more). Sekoia.io: partial, Rule cards show compatible intake formats; no source health tied to rules docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Noisy rules (Sekoia.io documents more). Sekoia.io: partial, 'Alert similarity' groups repeat matches 'rather than flooding the alert list'; 'Alert filters'; threshold tuning guidance docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Broken rules (Sekoia.io documents more). Sekoia.io: partial, 'Lag management' keeps SOL rules from missing late events; no failed-rule alerting on pages read docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Rule cost (Sekoia.io documents more). Sekoia.io: partial, 'Performance considerations' in testing best practices; no per-rule telemetry docs.sekoia.com read 2026-11-03. Sigma and pySigma: not documented, No page read for this platform names this feature raw.githubusercontent.com read 2026-11-03.
- Community (Sigma and pySigma documents more). Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03. Sigma and pySigma: documented, Community-maintained repo with contribution guide and rule types raw.githubusercontent.com read 2026-11-03.
Verdict by buyer type
Which of the two fits each kind of team.
| Buyer | Verdict |
|---|---|
| Microsoft Sentinel estate | Sigma and pySigma is the better fit: they convert Sigma to KQL through its Kusto backend, listed as Stable; Sekoia documents no Sentinel path. |
| Elastic estate | Sigma and pySigma is the better fit: they convert Sigma to Lucene, ES|QL and EQL through its Elasticsearch backend; Sekoia documents no Elastic path. |
| Splunk estate | Sigma and pySigma is the better fit: they convert Sigma to SPL through its Splunk backend; Sekoia documents no Splunk path. |
| Google SecOps estate | Sigma and pySigma is the only one of the pair with any stated route: they have a Google SecOps backend that its backend list marks as Development; Sekoia documents no Google SecOps path. |
| a team starting from scratch with Sigma | Both document a route: Sekoia runs native Sigma YAML, correlation rules included, but documents no CI workflow, and Sigma and pySigma are the format itself and converts it to Splunk, Kusto and Elasticsearch targets, with no runtime, tests or health checks, so the difference above decides. |
When to pick each
Sekoia.io: Pick Sekoia when testing is the deciding need: it tests a Sigma pattern against historical data in a rule testing view, with results that are not saved as a report. It also leads on rule health.
Sigma and pySigma: Pick Sigma and pySigma when published pricing is the deciding need: they are free and open source, with rules under DRL 1.1 and the tools under LGPL-2.1.
Profiles: Sekoia.io, Sigma and pySigma. Alternatives: to Sekoia.io, to Sigma and pySigma.