Technology and tools
What is Sigma rule?
A vendor-neutral format for writing log-based detection rules once and converting them to different SIEM query languages.
Sigma is an open, YAML-based format for describing log detections independently of any particular SIEM. A Sigma rule specifies the log source, the fields to match and the condition, and converters translate it into Splunk, Microsoft Sentinel, Elastic and other query languages.
It lets teams share detections in a common language, much as YARA does for files. The public SigmaHQ repository holds thousands of community rules, many mapped to MITRE ATT&CK techniques.