Repolode
Submit
SigmaHQ

SigmaHQ/sigma

A generic, vendor-neutral signature format for describing log-based detections, plus a large shared library of ready-to-use Sigma rules.

View on GitHubWebsite
Stars
11,332
Forks
2,890
Open issues
283
Last commit
3 days ago

What is it?

Sigma is an open, generic signature format for describing detection logic against log events. Rules are written in simple YAML and can be applied to any type of log file, much as Snort targets network traffic and YARA targets files. The goal is to let analysts capture a detection method once and share it in a standard form.

This repository is the main Sigma rule collection, with more than 3,000 detection rules maintained by a community of detection engineers. Rules are grouped into generic detection, threat hunting, emerging threats, compliance, and placeholder categories. Rules are converted to query languages for many SIEM and EDR platforms through the official Sigma CLI and the pySigma library.

The rules are released under the Detection Rule License (DRL) 1.1, and packaged rule sets are published on the project's release page.

Key features

  • 01Over 3,000 community-reviewed detection and hunting rules in YAML format.
  • 02Vendor-agnostic rule syntax that applies to any log source.
  • 03Rules organized into generic, threat hunting, emerging threats, compliance, and placeholder sets.
  • 04Conversion to SIEM and EDR query languages via the Sigma CLI and pySigma.

Use cases

  • Detection engineers who need a starting set of rules for a SIEM or EDR deployment.
  • Threat hunters looking for suspicious activity patterns in logs.
  • Teams writing their own detections who want a shared, portable format.
  • Security teams mapping log coverage to compliance frameworks.

Quick start

  1. 1

    Download the rule packages from the releases page

  2. 2

    Convert the rules to your SIEM query language with the official Sigma CLI

Things to know

  • Rules are released under the Detection Rule License 1.1, a custom license rather than a standard open-source license.
  • The repository holds detection rules, not a standalone program, so you need a converter or SIEM to use them.

In collections

OpenTelemetry & observability platforms

Topics

#siem#detection-rules#log-analysis#threat-hunting#yaml#incident-response#elasticsearch#ids#logging#monitoring

FAQ

What is sigma?
A generic, vendor-neutral signature format for describing log-based detections, plus a large shared library of ready-to-use Sigma rules. Sigma is an open, generic signature format for describing detection logic against log events. Rules are written in simple YAML and can be applied to any type of log file, much as Snort targets network traffic and YARA targets files. The goal is to let analysts capture a detection method once and share it in a standard form.
Is sigma free to use? What license does it have?
sigma is open source under the Other license. Check the license terms before using it in commercial products.
Is sigma still maintained?
Actively maintained. The last commit to sigma was on Oct 21, 2026.
What can I use sigma for?
Detection engineers who need a starting set of rules for a SIEM or EDR deployment. Threat hunters looking for suspicious activity patterns in logs. Teams writing their own detections who want a shared, portable format. Security teams mapping log coverage to compliance frameworks.
How do I install sigma?
Download the rule packages from the releases page Convert the rules to your SIEM query language with the official Sigma CLI
Where can I get sigma?
The source code and installation instructions are on GitHub: https://github.com/SigmaHQ/sigma

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects