Sigma
SigmaHQ · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
An open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule into the query language of a particular SIEM or log platform. The rule repository is actively released by SigmaHQ.
Who it is for, and when
Sigma solves the portability problem in log analysis: write the detection logic once and convert it to Splunk, Elastic, Sentinel, or whatever the client happens to run, rather than rewriting it per platform. For forensic work its value is that a rule is a citable, human-readable statement of what pattern in what log field you relied on — much easier to defend than a vendor's opaque alert name. The public ruleset is also a decent map of what log evidence is worth looking for at all.
What it does not cover
Sigma is a format, not an engine — it collects, parses, and detects nothing by itself, and every rule depends on log sources being configured and retained before the incident. Conversion is imperfect: a rule's behaviour on one backend is not guaranteed to match another, and field mappings must be validated per environment before a result is relied upon.
Go to the source
Open at sigmahq.io (opens in a new tab)https://sigmahq.io/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Publisher
- SigmaHQ
- Year
- 2026
- Topics
- log-analysis, threat-hunting, incident-response, windows, open-source, validation
- Checked at source
Related entries
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
Timesketch
FreeAn open-source web application for collaborative timeline analysis, built around the idea of a sketch that several analysts annotate, tag, and search at once. It ingests Plaso storage files, CSV, and JSONL. The project states plainly that it is code owned by Google rather than an official Google product.
Two complementary open-source network monitoring engines, both actively released. Zeek (formerly Bro) turns traffic into structured, protocol-aware logs — connections, HTTP requests, DNS queries, TLS handshakes, files seen — using its own scripting language. Suricata, from OISF, is a signature and rule-driven IDS/IPS that also produces rich EVE JSON records and can extract files.
A daily handler diary — distinct from the SANS DFIR blog — in which a rotating roster of volunteer handlers writes up whatever they are currently seeing in honeypot data, malware samples, exploit traffic and log telemetry.
How to build and run network security monitoring: where to place sensors, what to collect (full packet capture, session data, alert data), and how to work a case from an alert through the collected evidence to a conclusion about scope.