Sigma Rules

Sigma RulesPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

SigmaPython

A generic and open signature format for describing log event detections, shareable across SIEM systems.

Awesome Threat Detection and Hunting

A curated list of awesome open-source tools, detection rules, datasets, and resources for threat detection and hunting.

ChainsawRust

A fast, standalone tool for rapid threat hunting and forensic analysis of Windows event logs and other forensic artefacts.

HayabusaRust

A Sigma-based threat hunting and fast forensics timeline generator for Windows event logs, written in Rust.

YETIPython

A forensics intelligence platform that bridges CTI and DFIR by storing threat intelligence and enabling bulk observable searches and threat-focused analysis.

APT HunterPython

A threat hunting tool that analyzes Windows event logs to detect APT movements and suspicious activity using pre-defined rules and statistical analysis.

ZircolitePython

A standalone Python tool for applying SIGMA detection rules to EVTX, Auditd, Sysmon for Linux, and other log formats.

LeonidasPython

A framework for executing and detecting cloud attacker TTPs via YAML definitions, generating APIs, Sigma rules, and documentation.

InnerWardenRust

An autonomous open-source security agent for Linux that detects, scores, and automatically responds to threats using eBPF, AI, and collaborative defense.

WELAPowerShell

A PowerShell tool for auditing and configuring Windows event log settings to improve security visibility and detection capabilities.

detectionYARA

A collection of open-source threat detection rules for Snort, Sigma, and Yara security tools.

Sigma2KQLPython

Automatically converts Sigma detection rules to Kusto Query Language (KQL) for Microsoft Defender and Sentinel.

TerraSigmaHCL

Automates conversion of Sigma rules to Terraform and Sentinel YAML for detection engineering in Microsoft Sentinel.

Sigma2SPLPython

Automatically converts Sigma detection rules into Splunk SPL queries for security monitoring and threat hunting.