SigmaHQ/sigma

What it is

Sigma is an open signature format for describing relevant log events, often compared to Snort for network traffic or YARA for files. This repository is the main rule collection: over 3000 detection rules written in the format, organized into generic detection, threat hunting, emerging threat, compliance, and placeholder rule sets. The rules are vendor-agnostic, so one rule can be converted into queries for many SIEM and EDR products.

The project is for detection engineers, threat hunters, and defensive security practitioners who collect logs and want a shared, structured way to write and exchange detection methods instead of maintaining ad-hoc searches.

Getting started

1. Read the getting started guide and the Sigma rule specification to understand the YAML structure.
2. Download a rule package from the latest release, or browse the rule directories directly, such as generic detection rules and threat hunting rules.
3. Convert a rule into your SIEM's query language with the official Sigma CLI, or use a browser-based converter such as sigconverter.io or Detection Studio.
4. For integration into your own tooling, use pySigma.

Constraints and caveats

• Rules describe detection logic, not ready-to-run queries; conversion depends on the target backend and log source mapping.
• Generic rules are threat-agnostic, while emerging-threat rules are time-sensitive and may become stale; placeholder rules only gain meaning at conversion time.
• The repository content is released under the Detection Rule License 1.1, not a standard OSI license.
• False positives are expected in detection engineering; the project asks users to report them or propose new rules through issue templates.

HotRepo's take

On 2026-11-14 the repository appeared on the Python daily list at position 14, gaining 12 stars that day, with a total of 11,506 stars and 2,943 forks. That single snapshot is a thin signal, but it fits a long-running project whose value is the rule corpus itself rather than a fast-moving application. The breadth of listed integrations — from VirusTotal and MISP to Security Onion and QRadar — suggests the format is used well beyond this repository.