Deprecation

Deprecation is retiring a rule on purpose: marking it, warning its users and turning it off on a date. Reasons include a patched vulnerability, a better rule, a changed data source or a rule that never earned its alerts. A deprecation record keeps the rule's history without its noise.

What Deprecation means here

Public rule sets deprecate rules too, so a library is a moving target. Pin versions and read the change notes.

A team that never deprecates ends with a pile of rules nobody can explain.

Example of Deprecation in Sigma and pySigma documentation

Sigma's rule status field takes the values stable, test, experimental, deprecated and unsupported, so deprecation is part of the format itself. raw.githubusercontent.com read 2026-11-03

Terms related to Deprecation

• Rule lifecycle: Rule lifecycle is the set of states a rule moves through, from draft and test to production, scheduled for deprecation and retired.
• Content library: A content library is a vendor- or community-maintained set of ready-made detections.
• Rule versioning: Rule versioning keeps every revision of a rule so you can see what changed, who changed it and when.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.