Sigma

Sigma is an open YAML format for describing log-based detections once, so converters can turn them into queries for different SIEMs. It is maintained by the SigmaHQ community, with a public rules repository and a specification. It is a rule format, not a product, and it has no runtime of its own.

What Sigma means here

A Sigma rule names a log source, a detection condition and metadata such as a status and ATT&CK tags. The same rule file can then be converted for Splunk, Kusto, Elasticsearch and other backends through pySigma.

Conversion has limits. A field that does not exist in the target data model, a backend still in development or a correlation the target cannot express will break or change the result. Test the converted rule, not only the source.

Example of Sigma in Sigma and pySigma documentation

The SigmaHQ README names five rule directories: rules, rules-emerging-threats, rules-threat-hunting, rules-placeholder and rules-compliance. github.com read 2026-11-03

Terms related to Sigma

• pySigma: pySigma is the Python library that parses Sigma rules and converts them into queries through installable backend and pipeline plugins.
• Community rules: Community rules are detections written and shared by users, not by the product vendor.
• Deprecation: Deprecation is retiring a rule on purpose: marking it, warning its users and turning it off on a date.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.