What it does
Sigma is an open structured format and ecosystem for expressing log-event detections and translating them for supported security systems.
Sigma lets a team express a detection separately from a single SIEM's query syntax. Its site shows converting a structured rule for a target backend and documents how rule components fit together. Match the rule's expected log source to the events your environment actually collects before converting it. Review its false-positive notes and tune the result with local context. A portable rule format reduces repeated translation work; it does not remove the need to validate a detection.
Strengths
- Shareable detection logic and backend conversion
Best for
- Detection engineers maintaining rules across supported SIEMs