pySigma

pySigma is the Python library that parses Sigma rules and converts them into queries through installable backend and pipeline plugins. sigma-cli is its official command-line wrapper. It is open-source tooling under LGPL-2.1. It converts rules but does not store, run, test against data or deploy them.

What pySigma means here

Backends turn a rule into a target query language. Pipelines rename fields and adjust log sources so the query fits a particular data model. A team usually needs both: the Splunk backend and a pipeline for its field names, for example.

No total count of backends is published, so check the backends page for the one you need and its status before you plan around it.

Example of pySigma in Sigma and pySigma documentation

The pySigma repository names backend and pipeline packages for Splunk, Sysmon, CrowdStrike, NetWitness and Panther, and it gives no total count of backends. github.com read 2026-11-03

Terms related to pySigma

• Sigma: Sigma is an open YAML format for describing log-based detections once, so converters can turn them into queries for different SIEMs.
• Detection repository: A detection repository is the git repository that holds rules, tests and pipeline files.
• KQL: KQL, the Kusto Query Language, is the query language of Microsoft Sentinel analytics rules and hunting.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.