Sigma is an open, generic signature format for describing detections over log events. You write the detection once in YAML, and a converter turns it into the query language of your own log platform. The project describes it as being for log files what Snort is for network traffic.
Why it exists
Every logging platform has its own query language. A detection written for one cannot be pasted into another. Sigma gives analysts a neutral way to share what they have learned, so a rule written by one team can be used by another with a conversion step.
What a rule describes
A Sigma rule is a YAML file. It says what log source it applies to, what events to match, and some context about the rule such as a title and what it is meant to catch. For the exact field list, use the Sigma specification and getting started guide in the project repository, which are the authoritative references.
The rule does not run by itself. It is a description. That is the whole point: the description is portable and the execution is local.
Where the rules come from
The community repository organizes rules into categories:
- Generic detection rules, aimed at behavior or techniques regardless of the threat actor.
- Threat hunting rules, broader and meant as starting points.
- Emerging threat rules, for specific, time sensitive threats.
- Compliance rules, mapped to frameworks such as CIS Controls and NIST.
- Placeholder rules, whose final meaning is filled in when converted.
How conversion works
The project lists several tools. Sigma CLI is the official command line converter. There are web based converters, and pySigma is a library for building rule conversion into your own tooling.
The conversion step maps Sigma field names to the field names your log platform uses. If your logs are parsed differently, you adapt the mapping, not every rule.
A sensible way to start
- Pick one log source you already collect, for example Windows process creation events.
- Choose five generic rules that match techniques you care about.
- Convert them and run them against historical data. See what fires.
- Tune exclusions with written reasons.
- Put the rules in version control and review changes like code.
Limits
A rule is only as good as the logs under it. If process command lines are not collected, a rule about command lines cannot work. Also, a published rule is not tuned to your environment, so expect false positives. Treat community rules as a draft to adapt.
Quick check
Is Sigma a product?
No. It is an open format with community rules and open source converters. You still need a log platform to run the converted queries.
Can I use Sigma for network traffic or files?
Not for those directly. It targets log events. Network signature formats and file pattern formats such as YARA cover the other cases.
Sources
Last reviewed: 19 October 2026.
