Sigma
A generic and open signature format for describing log event detections, shareable across SIEM systems.
What is Sigma?
Sigma is a generic and open signature format for describing log event detections in a structured YAML format. It solves the problem of vendor lock-in by allowing security teams to write detection rules once and convert them to various SIEM query languages, facilitating sharing and collaboration across the security community.
Detection engineers, threat hunters, defensive security practitioners, and SOC analysts who need to create, share, and implement detection rules across different SIEM platforms.
Developers choose Sigma because it provides a vendor-agnostic, community-driven repository of over 3000 peer-reviewed rules, eliminating the need to rewrite detections for each SIEM and improving collective defense capabilities through open collaboration.
Overview
Main Sigma Rule Repository
Use Cases
Best For
- Creating vendor-agnostic detection rules for multi-SIEM environments
- Sharing threat detection logic across security teams and reports
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
