Elastic Security SIEM
Modern, cost-efficient SIEM with years of searchable data.
Open-Source Projects
Discover top open-source software, updated regularly with real-world adoption signals.
Discover top open-source software, updated regularly with real-world adoption signals.
Standardized, vendor-agnostic signatures for log-based threat detection
Sigma offers a flexible, community‑reviewed signature format for log events, enabling detection engineers and threat hunters to share and apply thousands of vendor‑agnostic rules across any SIEM.
When teams consider Sigma, these hosted platforms usually appear on the same shortlist.
Looking for a hosted option? These are the services engineering teams benchmark against before choosing open source.
Unified detection across heterogeneous log sources
Deploy a single rule set that generates consistent alerts regardless of the underlying SIEM.
Rapid response to emerging APT campaigns
Leverage timely Emerging Threat rules to detect new adversary techniques as they appear.
Automated conversion to native SIEM queries
Use Sigma CLI or pySigma to translate rules into Splunk, Elastic, or other platform queries for immediate integration.
Community sharing of custom detection logic
Contribute peer‑reviewed rules and benefit from a growing repository of shared expertise.
Sigma provides a standardized, vendor‑agnostic format to describe log‑event detections, making rules shareable and reusable across any SIEM.
Download rule packages, then convert them to your SIEM’s query language using the Sigma CLI, sigconverter.io, or the pySigma library.
Rules are contributed by a global community of detection engineers and are peer‑reviewed before inclusion in the main repository.
The rule content is released under the Detection Rule License (DRL) 1.1.
Follow the CONTRIBUTING guide in the repository and submit a pull request with your rule, adhering to the Sigma format.
Project at a glance
ActiveLast synced 4 days ago
