PageSourceSearch

https://sigmahq.io/docs/guide/getting-started.html

html sigmahq.io collected 2026-10-02 05:31:29 UTC 116,969 bytes, 183 lines download raw bytes

1<!DOCTYPE html>
2<html lang="en-US" dir="ltr">
3  <head>
4    <meta charset="utf-8">
5    <meta name="viewport" content="width=device-width,initial-scale=1">
6    <title>Getting Started | Sigma Detection Format</title>
7    <meta name="description" content="A generic and open signature format that allows you to describe relevant log events in a straight-forward manner.">
8    <meta name="generator" content="VitePress v1.6.4">
9    <link rel="preload stylesheet" href="/assets/style.TrRP7cnp.css" as="style">
10    <link rel="preload stylesheet" href="/vp-icons.css" as="style">
11    
12    
12<script type="module" src="/assets/app.DG-65pY8.js"></script>
12
13    <link rel="preload" href="/assets/inter-roman-latin.Di8DUHzh.woff2" as="font" type="font/woff2" crossorigin="">
14    <link rel="modulepreload" href="/assets/chunks/theme.DnBCZL2n.js">
15    <link rel="modulepreload" href="/assets/chunks/framework.D_PIGg_o.js">
16    <link rel="modulepreload" href="/assets/chunks/PipelinesBox.DWJmhm_r.js">
17    <link rel="modulepreload" href="/assets/docs_guide_getting-started.md.Bp3-SdKr.lean.js">
18    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="57x57" href="/favicon/dark/apple-touch-icon-57x57.png">
19    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="114x114" href="/favicon/dark/apple-touch-icon-114x114.png">
20    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="72x72" href="/favicon/dark/apple-touch-icon-72x72.png">
21    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="144x144" href="/favicon/dark/apple-touch-icon-144x144.png">
22    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="60x60" href="/favicon/dark/apple-touch-icon-60x60.png">
23    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="120x120" href="/favicon/dark/apple-touch-icon-120x120.png">
24    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="76x76" href="/favicon/dark/apple-touch-icon-76x76.png">
25    <link media="(prefers-color-scheme: dark)" rel="apple-touch-icon-precomposed" sizes="152x152" href="/favicon/dark/apple-touch-icon-152x152.png">
26    <link media="(prefers-color-scheme: dark)" rel="icon" type="image/png" href="/favicon/dark/favicon-196x196.png" sizes="196x196">
27    <link media="(prefers-color-scheme: dark)" rel="icon" type="image/png" href="/favicon/dark/favicon-96x96.png" sizes="96x96">
28    <link media="(prefers-color-scheme: dark)" rel="icon" type="image/png" href="/favicon/dark/favicon-32x32.png" sizes="32x32">
29    <link media="(prefers-color-scheme: dark)" rel="icon" type="image/png" href="/favicon/dark/favicon-16x16.png" sizes="16x16">
30    <link media="(prefers-color-scheme: dark)" rel="icon" type="image/png" href="/favicon/dark/favicon-128.png" sizes="128x128">
31    <link rel="manifest" href="/favicon/site.webmanifest">
32    <meta name="theme-color" content="#12141c">
33    <meta property="og:title" content="Explore Sigma">
34    <meta property="og:description" content="A generic and open signature format that allows you to describe relevant log events in a straight-forward manner.">
35    <meta property="og:type" content="website">
36    <meta property="og:url" content="https://sigmahq.io/">
37    <meta property="og:image" content="https://sigmahq.io/images/og_image.jpg">
vendor: 68 bytes, lines 37-38
37
38    <script async src="https://www.googletagmanager.com/gtag/js?id=
38UA-288648316-1
vendor: 16 bytes, lines 38-39
38"></script>
39    
39<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","UA-288648316-1");</script>
39
40    
40<script id="check-dark-mode">(()=>{const e=localStorage.getItem("vitepress-theme-appearance")||"auto",a=window.matchMedia("(prefers-color-scheme: dark)").matches;(!e||e==="auto"?a:e==="dark")&&document.documentElement.classList.add("dark")})();</script>
40
41    
41<script id="check-mac-os">document.documentElement.classList.toggle("mac",/Mac|iPhone|iPod|iPad/i.test(navigator.platform));</script>
41
42  </head>
43  <body>
44    <div id="app"><div class="Layout" data-v-d8b57b2d><!--[--><!--]--><!--[--><span tabindex="-1" data-v-fcbfc0e0></span><a href="#VPContent" class="VPSkipLink visually-hidden" data-v-fcbfc0e0>Skip to content</a><!--]--><!----><header class="VPNav" data-v-d8b57b2d data-v-7ad780c2><div class="VPNavBar" data-v-7ad780c2 data-v-9fd4d1dd><div class="wrapper" data-v-9fd4d1dd><div class="container" data-v-9fd4d1dd><div class="title" data-v-9fd4d1dd><div class="VPNavBarTitle has-sidebar" data-v-9fd4d1dd data-v-9f43907a><a class="title" href="/" data-v-9f43907a><!--[--><!--]--><!--[--><!--[--><!--[--><img class="VPImage dark logo" src="/images/logo.svg" alt data-v-ab19afbb><!--]--><!--[--><img class="VPImage light logo" src="/images/logo_light.svg" alt data-v-ab19afbb><!--]--><!--]--><!--]--><span data-v-9f43907a>Sigma</span><!--[--><!--[--><!--[--><!--[--><div class="absolute top-10 left-12 block text-[10pt] text-[var(--vp-c-brand-1)]"> Documentation </div><!--]--><!--]--><!--]--><!--]--></a></div></div><div class="content" data-v-9fd4d1dd><div class="content-body" data-v-9fd4d1dd><!--[--><!--[--><!--[--><div class="hidden w-full md:block"></div><!--]--><!--]--><!--]--><div class="VPNavBarSearch search" data-v-9fd4d1dd><!--[--><!----><div id="local-search"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><span class="vp-icon DocSearch-Search-Icon"></span><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"><kbd class="DocSearch-Button-Key"></kbd><kbd class="DocSearch-Button-Key">K</kbd></span></button></div><!--]--></div><nav aria-labelledby="main-nav-aria-label" class="VPNavBarMenu menu" data-v-9fd4d1dd data-v-afb2845e><span id="main-nav-aria-label" class="visually-hidden" data-v-afb2845e> Main Navigation </span><!--[--><!--[--><a class="VPLink link VPNavBarMenuLink active" href="/docs/guide/getting-started.html" tabindex="0" data-v-afb2845e data-v-815115f5><!--[--><span data-v-815115f5>Documentation</span><!--]--></a><!--]--><!--[--><a class="VPLink link vp-external-link-icon VPNavBarMenuLink" href="https://github.com/SigmaHQ/sigma" target="_blank" rel="noreferrer" tabindex="0" data-v-afb2845e data-v-815115f5><!--[--><span data-v-815115f5>Rules</span><!--]--></a><!--]--><!--[--><a class="VPLink link vp-external-link-icon VPNavBarMenuLink" href="https://medium.com/sigma-hq" target="_blank" rel="noreferrer" tabindex="0" data-v-afb2845e data-v-815115f5><!--[--><span data-v-815115f5>Blog</span><!--]--></a><!--]--><!--[--><div class="VPFlyout VPNavBarMenuGroup" data-v-afb2845e data-v-bfe7971f><button type="button" class="button" aria-haspopup="true" aria-expanded="false" data-v-bfe7971f><span class="text" data-v-bfe7971f><!----><span data-v-bfe7971f>Misc</span><span class="vpi-chevron-down text-icon" data-v-bfe7971f></span></span></button><div class="menu" data-v-bfe7971f><div class="VPMenu" data-v-bfe7971f data-v-20ed86d6><div class="items" data-v-20ed86d6><!--[--><!--[--><div class="VPMenuLink" data-v-20ed86d6 data-v-7eeeb2dc><a class="VPLink link vp-external-link-icon" href="https://github.com/SigmaHQ/sigma-specification/" target="_blank" rel="noreferrer" data-v-7eeeb2dc><!--[--><span data-v-7eeeb2dc>Sigma Specification</span><!--]--></a></div><!--]--><!--[--><div class="VPMenuLink" data-v-20ed86d6 data-v-7eeeb2dc><a class="VPLink link vp-external-link-icon" href="https://github.com/SigmaHQ/sigmahq.github.io" target="_blank" rel="noreferrer" data-v-7eeeb2dc><!--[--><span data-v-7eeeb2dc>Changelog</span><!--]--></a></div><!--]--><!--]--></div><!--[--><!--]--></div></div></div><!--]--><!--]--></nav><!----><div class="VPNavBarAppearance appearance" data-v-9fd4d1dd data-v-3f90c1a5><button class="VPSwitch VPSwitchAppearance" type="button" role="switch" title aria-checked="false" data-v-3f90c1a5 data-v-be9742d9 data-v-b4ccac88><span class="check" data-v-b4ccac88><span class="icon" data-v-b4ccac88><!--[--><span class="vpi-sun sun" data-v-be9742d9></span><span class="vpi-moon moon" data-v-be9742d9></span><!--]--></span></span></button></div><div class="VPSocialLinks VPNavBarSocialLinks social-links" data-v-9fd4d1dd data-v-ef6192dc data-v-e71e869c><!--[--><a class="VPSocialLink no-icon" href="https://discord.gg/kQQBn5W2z5" aria-label="discord" target="_blank" rel="noopener" data-v-e71e869c data-v-60a9a2d3><span class="vpi-social-discord"></span></a><a class="VPSocialLink no-icon" href="https://twitter.com/Sigma_HQ/" aria-label="twitter" target="_blank" rel="noopener" data-v-e71e869c data-v-60a9a2d3><span class="vpi-social-twitter"></span></a><a class="VPSocialLink no-icon" href="https://github.com/SigmaHQ/sigma" aria-label="github" target="_blank" rel="noopener" data-v-e71e869c data-v-60a9a2d3><span class="vpi-social-github"></span></a>
44<!--]--></div><div class="VPFlyout VPNavBarExtra extra" data-v-9fd4d1dd data-v-f953d92f data-v-bfe7971f><button type="button" class="button" aria-haspopup="true" aria-expanded="false" aria-label="extra navigation" data-v-bfe7971f><span class="vpi-more-horizontal icon" data-v-bfe7971f></span></button><div class="menu" data-v-bfe7971f><div class="VPMenu" data-v-bfe7971f data-v-20ed86d6><!----><!--[--><!--[--><!----><div class="group" data-v-f953d92f><div class="item appearance" data-v-f953d92f><p class="label" data-v-f953d92f>Appearance</p><div class="appearance-action" data-v-f953d92f><button class="VPSwitch VPSwitchAppearance" type="button" role="switch" title aria-checked="false" data-v-f953d92f data-v-be9742d9 data-v-b4ccac88><span class="check" data-v-b4ccac88><span class="icon" data-v-b4ccac88><!--[--><span class="vpi-sun sun" data-v-be9742d9></span><span class="vpi-moon moon" data-v-be9742d9></span><!--]--></span></span></button></div></div></div><div class="group" data-v-f953d92f><div class="item social-links" data-v-f953d92f><div class="VPSocialLinks social-links-list" data-v-f953d92f data-v-e71e869c><!--[--><a class="VPSocialLink no-icon" href="https://discord.gg/kQQBn5W2z5" aria-label="discord" target="_blank" rel="noopener" data-v-e71e869c data-v-60a9a2d3><span class="vpi-social-discord"></span></a><a class="VPSocialLink no-icon" href="https://twitter.com/Sigma_HQ/" aria-label="twitter" target="_blank" rel="noopener" data-v-e71e869c data-v-60a9a2d3><span class="vpi-social-twitter"></span></a><a class="VPSocialLink no-icon" href="https://github.com/SigmaHQ/sigma" aria-label="github" target="_blank" rel="noopener" data-v-e71e869c data-v-60a9a2d3><span class="vpi-social-github"></span></a><!--]--></div></div></div><!--]--><!--]--></div></div></div><!--[--><!--]--><button type="button" class="VPNavBarHamburger hamburger" aria-label="mobile navigation" aria-expanded="false" aria-controls="VPNavScreen" data-v-9fd4d1dd data-v-6bee1efd><span class="container" data-v-6bee1efd><span class="top" data-v-6bee1efd></span><span class="middle" data-v-6bee1efd></span><span class="bottom" data-v-6bee1efd></span></span></button></div></div></div></div><div class="divider" data-v-9fd4d1dd><div class="divider-line" data-v-9fd4d1dd></div></div></div><!----></header><div class="VPLocalNav has-sidebar empty" data-v-d8b57b2d data-v-2488c25a><div class="container" data-v-2488c25a><button class="menu" aria-expanded="false" aria-controls="VPSidebarNav" data-v-2488c25a><span class="vpi-align-left menu-icon" data-v-2488c25a></span><span class="menu-text" data-v-2488c25a>Menu</span></button><div class="VPLocalNavOutlineDropdown" style="--vp-vh:0px;" data-v-2488c25a data-v-6b867909><button data-v-6b867909>Return to top</button><!----></div></div></div><aside class="VPSidebar" data-v-d8b57b2d data-v-42c4c606><div class="curtain" data-v-42c4c606></div><nav class="nav" id="VPSidebarNav" aria-labelledby="sidebar-aria-label" tabindex="-1" data-v-42c4c606><span class="visually-hidden" id="sidebar-aria-label" data-v-42c4c606> Sidebar Navigation </span><!--[--><!--[--><div class="group flex flex-col gap-2 pt-6 pb-4"><a href="/docs/guide/getting-started.html" class="bg-sky-400/[0.08] group-hover:bg-transparent hover:!bg-sky-400/10 -m-1.5 flex items-center gap-3 rounded-xl p-1.5 text-sm font-semibold text-sky-500 transition-all hover:bg-sky-400/10 dark:text-sky-200 dark:hover:bg-sky-400/20"><span class="box block flex h-7 w-7 items-center justify-center rounded-lg bg-sky-400/20 dark:bg-sky-500/20"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" data-slot="icon" class="h-4 text-sky-500 dark:text-sky-400"><path d="M10.75 16.82A7.462 7.462 0 0 1 15 15.5c.71 0 1.396.098 2.046.282A.75.75 0 0 0 18 15.06v-11a.75.75 0 0 0-.546-.721A9.006 9.006 0 0 0 15 3a8.963 8.963 0 0 0-4.25 1.065V16.82ZM9.25 4.065A8.963 8.963 0 0 0 5 3c-.85 0-1.673.118-2.454.339A.75.75 0 0 0 2 4.06v11a.75.75 0 0 0 .954.721A7.506 7.506 0 0 1 5 15.5c1.579 0 3.042.487 4.25 1.32V4.065Z"></path></svg></span> Documentation </a><a href="/resources/" class="-m-1.5 flex items-center gap-3 rounded-xl p-1.5 text-sm font-semibold text-indigo-500 transition-all hover:bg-indigo-400/10 dark:text-indigo-200 dark:hover:bg-indigo-400/20"><span class="box block flex h-7 w-7 items-center justify-center rounded-lg bg-indigo-400/20 dark:bg-indigo-500/20"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true" data-slot="icon" class="h-4 text-indigo-500 dark:text-indigo-400"><path fill-rule="evenodd" d="M2.5 3A1.5 1.5 0 0 0 1 4.5v4A1.5 1.5 0 0 0 2.5 10h6A1.5 1.5 0 0 0 10 8.5v-4A1.5 1.5 0 0 0 8.5 3h-6Zm11 2A1.5 1.5 0 0 0 12 6.5v7a1.5 1.5 0 0 0 1.5 1.5h4a1.5 1.5 0 0 0 1.5-1.5v-7A1.5 1.5 0 0 0 17.5 5h-4Zm-10 7A1.5 1.5 0 0 0 2 13.5v2A1.5 1.5 0 0 0 3.5 17h6a1.5 1.5 0 0 0 1.5-1.5v-2A1.5 1.5 0 0 0 9.5 12h-6Z" clip-rule="evenodd"></path></svg></span>
44 Resources </a></div><!--]--><!--]--><!--[--><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0 has-active" data-v-51288d80 data-v-0009425e><div class="item" role="button" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><h2 class="text" data-v-0009425e>Introduction</h2><!----></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/guide/about.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>About Sigma</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/guide/getting-started.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Getting Started</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/guide/faq.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>FAQs</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0" data-v-51288d80 data-v-0009425e><div class="item" role="button" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><h2 class="text" data-v-0009425e>Sigma Basics</h2><!----></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/basics/rules.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Rules</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/basics/modifiers.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Modifiers</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/basics/conditions.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Conditions</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/basics/log-sources.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Log Sources</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0 is-link" data-v-51288d80 data-v-0009425e><div class="item" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/meta/" data-v-0009425e><!--[--><h2 class="text" data-v-0009425e>Meta Rules</h2><!--]--></a><!----></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/meta/correlations.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Correlations</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/meta/filters.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Filters</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0" data-v-51288d80 data-v-0009425e><div class="item" role="button" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><h2 class="text" data-v-0009425e>Digging Deeper</h2><!----></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/digging-deeper/backends.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Backends</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/digging-deeper/pipelines.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Pipelines</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/digging-deeper/contributing.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Contributing</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0" data-v-51288d80 data-v-0009425e><div class="item" role="button" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><h2 class="text" data-v-0009425e>Backends</h2><!----></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/pySigma-backend-elasticsearch" target="_blank" rel="_target" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Elasticsearch</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/pySigma-backend-splunk" target="_blank" rel="_target" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Splunk</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/grafana/pySigma-backend-loki" target="_blank" rel="_target" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Grafana Loki</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/AttackIQ/pySigma-backend-microsoft365defender" target="_blank" rel="_target" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Azure Sentinel / Microsoft 365 Defender</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/pySigma-backend-crowdstrike" target="_blank" rel="_target" data-v-0009425e><!--[--><p class="text" data-v-0009425e>CrowdStrike Falcon LogScale </p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link link" href="/docs/digging-deeper/backends.html" data-v-0009425e><!--[--><p class="text" data-v-0009425e>More  ›</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0 collapsible collapsed" data-v-51288d80 data-v-0009425e><div class="item" role="button" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><h2 class="text" data-v-0009425e>Ecosystem</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-0009425e><span class="vpi-chevron-right caret-icon" data-v-0009425e></span></div></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Rules Main Repo</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma/releases" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Rule Packages</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/pySigma" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>pySigma</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-cl
44i" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma CLI</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><div class="no-transition group" data-v-51288d80><section class="VPSidebarItem level-0 collapsible collapsed" data-v-51288d80 data-v-0009425e><div class="item" role="button" tabindex="0" data-v-0009425e><div class="indicator" data-v-0009425e></div><h2 class="text" data-v-0009425e>Specification</h2><div class="caret" role="button" aria-label="toggle section" tabindex="0" data-v-0009425e><span class="vpi-chevron-right caret-icon" data-v-0009425e></span></div></div><div class="items" data-v-0009425e><!--[--><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-rules-specification.md" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Rules</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Correlations</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-filters-specification.md" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Filters</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-modifiers-appendix.md" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Modifiers Appendix</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-tags-appendix.md" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Tags Appendix</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-taxonomy-appendix.md" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>Sigma Taxonomy Appendix</p><!--]--></a><!----></div><!----></div><div class="VPSidebarItem level-1 is-link" data-v-0009425e data-v-0009425e><div class="item" data-v-0009425e><div class="indicator" data-v-0009425e></div><a class="VPLink link vp-external-link-icon link" href="https://github.com/SigmaHQ/sigma-specification/tree/main/sigmahq" target="_blank" rel="noreferrer" data-v-0009425e><!--[--><p class="text" data-v-0009425e>SigmaHQ Conventions</p><!--]--></a><!----></div><!----></div><!--]--></div></section></div><!--]--><!--[--><!--[--><div class="block w-full border-t border-[var(--vp-c-divider)] pt-6 text-xs text-slate-400 transition-all dark:text-slate-700"><div class="mb-0.5 font-semibold"> Copyright © <a href="https://sigmahq.io/">SigmaHQ</a> 2026</div><div class="flex gap-2"><a href="https://github.com/SigmaHQ/" class="hover:text-cyan-600" target="_blank">Github</a><span class="opacity-30">|</span><a href="https://twitter.com/Sigma_HQ/" class="hover:text-cyan-600" target="_blank">X.com</a><span class="opacity-30">|</span><a href="https://discord.gg/kQQBn5W2z5" class="hover:text-cyan-600" target="_blank">Discord</a></div></div><!--]--><!--]--></nav></aside><div class="VPContent has-sidebar" id="VPContent" data-v-d8b57b2d data-v-9a6c75ad><div class="VPDoc has-sidebar has-aside" data-v-9a6c75ad data-v-e6f2a212><!--[--><!--]--><div class="container" data-v-e6f2a212><div class="aside" data-v-e6f2a212><div class="aside-curtain" data-v-e6f2a212></div><div class="aside-container" data-v-e6f2a212><div class="aside-content" data-v-e6f2a212><div class="VPDocAside" data-v-e6f2a212 data-v-cb998dce><!--[--><!--]--><!--[--><!--]--><nav aria-labelledby="doc-outline-aria-label" class="VPDocAsideOutline" data-v-cb998dce data-v-f610f197><div class="content" data-v-f610f197><div class="outline-marker" data-v-f610f197></div><div aria-level="2" class="outline-title" id="doc-outline-aria-label" role="heading" data-v-f610f197>On this page</div><ul class="VPDocOutlineItem root" data-v-f610f197 data-v-53c99d69><!--[--><!--]--></ul></div></nav><!--[--><!--]--><div class="spacer" data-v-cb998dce></div><!--[--><!--]--><!----><!--[--><!--]--><!--[--><!--]--></div></div></div></div><div class="content" data-v-e6f2a212><div class="content-container" data-v-e6f2a212><!--[--><!--]--><main class="main" data-v-e6f2a212><div style="position:relative;" class="vp-doc _docs_guide_getting-started" data-v-e6f2a212><div>
44<h1 id="frontmatter-title" tabindex="-1">Getting Started <a class="header-anchor" href="#frontmatter-title" aria-label="Permalink to &quot;{{ $frontmatter.title }}&quot;">​</a></h1><p>Sigma is an open format for writing detection rules in YAML. A single rule converts into a query for whichever SIEM you run, whether that is Splunk, Elasticsearch, Microsoft Sentinel, Grafana Loki, or <a href="/docs/digging-deeper/backends.html">one of many others</a>. Your detections become portable, vendor-neutral, and easy to share across teams and tooling.</p><p>This guide takes you from installing the converter to writing a rule and turning it into effective, workable SIEM queries. It assumes no prior Sigma experience and doubles as a reference once you are comfortable.</p><div class="tip custom-block"><p class="custom-block-title">Try it as you read</p><p>The converters throughout this guide run entirely in your browser. Edit the YAML, choose a target SIEM, and the query updates as you type. Install the CLI when you want to run conversions locally.</p></div><h2 id="installation" tabindex="-1">Installation <a class="header-anchor" href="#installation" aria-label="Permalink to &quot;Installation&quot;">​</a></h2><p>The Sigma ecosystem offers several tools for your use. This documentation will mainly focus on the primary Sigma converter, called <code>sigma-cli</code>, which converts all Sigma rules into usable SIEM queries for your security environment(s).</p><h3 id="requirements" tabindex="-1">Requirements <a class="header-anchor" href="#requirements" aria-label="Permalink to &quot;Requirements&quot;">​</a></h3><p>To use <code>sigma-cli</code> (the Sigma Rule Converter) &amp; the underlying library, you must have Python &gt;= <code>3.9</code> installed.</p><hr><h3 id="using-uvx" tabindex="-1">Using <code>uvx</code> <a class="header-anchor" href="#using-uvx" aria-label="Permalink to &quot;Using `uvx`&quot;">​</a></h3><p>The easiest way to run <code>sigma-cli</code> without a permanent installation is with <a href="https://docs.astral.sh/uv/" target="_blank" rel="noreferrer"><code>uvx</code></a>, a tool runner from the <a href="https://docs.astral.sh/uv/" target="_blank" rel="noreferrer">uv</a> project. It downloads and runs <code>sigma-cli</code> in a temporary environment with no setup required.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">uvx</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --from</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma</span></span></code></pre></div><div class="tip custom-block"><p class="custom-block-title">TIP</p><p><code>uvx</code> is provided by <a href="https://docs.astral.sh/uv/" target="_blank" rel="noreferrer">uv</a>. If you don&#39;t have it yet, install it with <code>pip install uv</code> or visit the <a href="https://docs.astral.sh/uv/getting-started/installation/" target="_blank" rel="noreferrer">uv installation docs</a>.</p></div><h3 id="using-pip" tabindex="-1">Using <code>pip</code> <a class="header-anchor" href="#using-pip" aria-label="Permalink to &quot;Using `pip`&quot;">​</a></h3><p>Alternatively, you can install <code>sigma-cli</code> permanently through the Python 3 package manager <em><code>pip</code></em>.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">pip3</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> install</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span></span></code></pre></div><div class="tip custom-block"><p class="custom-block-title">TIP</p><p>Be sure that you&#39;ve added Python&#39;s binary location (usually <code>~/.local/bin</code>) to your PATH, so you can run <code>
44sigma-cli</code> straight from your CLI. <a href="https://packaging.python.org/en/latest/tutorials/installing-packages/#installing-to-the-user-site" target="_blank" rel="noreferrer">Visit Python&#39;s website for Windows and more info.</a></p></div><h3 id="or-from-source" tabindex="-1">or from Source <a class="header-anchor" href="#or-from-source" aria-label="Permalink to &quot;or from Source&quot;">​</a></h3><p>If you don&#39;t want to use <code>pip</code>, or if you instead want to download and install <code>sigma-cli</code> from source, first install <a href="https://python-poetry.org/docs/basic-usage/" target="_blank" rel="noreferrer">Poetry</a> on your system, then clone and install the required dependencies using Poetry.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">git</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> clone</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> https://github.com/SigmaHQ/sigma-cli.git</span></span>
45<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">cd</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span></span>
46<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">poetry</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> install</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> &amp;&amp; </span><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">poetry</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> shell</span></span>
47<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> version</span></span></code></pre></div><h2 id="install-your-siem-plugin" tabindex="-1">Install your SIEM plugin <div class="inline-block -mt-3"><span class="VPBadge warning"><!--[-->pip only<!--]--></span></div> <a class="header-anchor" href="#install-your-siem-plugin" aria-label="Permalink to &quot;Install your SIEM plugin &lt;div class=&quot;inline-block -mt-3&quot;&gt;&lt;Badge  type=&quot;warning&quot; text=&quot;pip only&quot; /&gt;&lt;/div&gt;&quot;">​</a></h2><p>Once you&#39;ve <a href="#installation">installed <code>sigma-cli</code></a>, you will need to install your backend plugin through <code>sigma-cli</code>.</p><p>Newly introduced, the <code>sigma-cli</code> tool now offers a selection of <strong>installable <a href="/docs/digging-deeper/backends.html">backends</a></strong> – through a plugin system, each designed to target a specific SIEM commonly used by users. To see which backend plugins are available, run the <code>sigma plugin list</code> command from the command line.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> plugin</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> list</span></span></code></pre></div><div class="language-text vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">text</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span>+----------------------+----------+---------+--------------------------------------------------------------+-------------+</span></span>
48<span class="line"><span>| Identifier           | Type     | State   | Description                                                  | Compatible? |</span></span>
49<span class="line"><span>+----------------------+----------+---------+--------------------------------------------------------------+-------------+</span></span>
50<span class="line"><span>| splunk               | backend  | stable  | Splunk backend for conversion into SPL ...                   | yes         |</span></span>
51<span class="line"><span>...</span></span>
52<span class="line"><span>+----------------------+----------+---------+--------------------------------------------------------------+-------------+</span></span></code></pre></div><p>To install a backend plugin, use the <code>sigma plugin install</code> command, followed by the backend identifier.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span>
52<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> plugin</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> install</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span></span></code></pre></div><p>Install the backend for whichever SIEM you target — for example <code>splunk</code>, <code>elasticsearch</code>, <code>loki</code>, or <code>microsoft365defender</code>. The rest is identical regardless of platform.</p><p>If you&#39;re using <code>uvx</code>, you don&#39;t install the plugin separately. Take the plugin&#39;s package name (for Splunk, <code>pysigma-backend-splunk</code>) and add it to the <code>uvx</code> oneliner with <code>--with</code>, as shown in the conversion examples below.</p><div class="info custom-block"><p class="custom-block-title">Pick your platform</p><p>The examples below use <strong>Splunk</strong> as a concrete walkthrough, but Sigma converts to dozens of SIEMs. Swap <code>splunk</code> for your own target (and its backend package) and every command works the same way. Browse the full list on the <a href="/docs/digging-deeper/backends.html">Backends</a> page.</p></div><h2 id="converting-sigma-rules" tabindex="-1">Converting Sigma Rules <a class="header-anchor" href="#converting-sigma-rules" aria-label="Permalink to &quot;Converting Sigma Rules&quot;">​</a></h2><h3 id="basic-example" tabindex="-1">Basic Example <a class="header-anchor" href="#basic-example" aria-label="Permalink to &quot;Basic Example&quot;">​</a></h3><p>Once you have installed the <code>sigma-cli</code> tool and the associated SIEM backend plugin, create a directory that will contain your Sigma rules and function as your <strong>&quot;detection-as-code&quot;</strong> repository. Consolidating your rules in one place is considered best practice and simplifies the deployment process.</p><p>Next, to create a Sigma rule that will detect when someone tries to <u>disable</u> <strong>Windows Defender&#39;s Threat Protection</strong>, create a <a href="https://yaml.org/" target="_blank" rel="noreferrer"><code>YAML</code></a> file called <code>windows_defender_threat_detection_disabled.yml</code> and fill it with the example Sigma detection shown below.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># Create a test repository to store your detections-as-code</span></span>
53<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">mkdir</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma_test_repo</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> &amp;&amp; </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">cd</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma_test_repo</span></span>
54<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">mkdir</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ./rules</span></span>
55<span class="line"></span>
56<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># Create a new Sigma rule</span></span>
57<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">vim</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ./rules/windows_defender_threat_detection_disabled.yml</span></span></code></pre></div><p>A Sigma rule is comprised of three sections: a title, the log source it applies to, and the detection logic that fires on a match.</p><div class="tip custom-block"><p class="custom-block-title">Convert it live</p><p>Click <strong>Live Edit</strong> below, then choose a target from the dropdown to see this rule rendered as Splunk, ES|QL, Loki, KQL, and more.</p></div><div class="sigma-converter not-prose my-8" data-v-b4727905><div class="sigma-converter-static" style="" data-v-b4727905><!--[--><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-xwVHR" id="tab-1W8EKCB" checked><label data-title="windows_defender_threat_detection_disabled.yml" for="tab-1W8EKCB">windows_defender_threat_detection_disabled.yml</label></div><div class="blocks"><div class="language-yaml vp-adaptive-theme active line-numbers-mode"><button title="Copy Code" class="copy"></button><span class="lang">yaml</span>
57<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">title</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Windows Defender Threat Detection Disabled</span></span>
58<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">logsource</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
59<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">    # Windows Defender</span></span>
60<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    product</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">windows</span></span>
61<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    service</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">windefend</span></span>
62<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">detection</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
63<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    selection</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
64<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;">        # The detection itself</span></span>
65<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">        EventID</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
66<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">            - </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">5001</span></span>
67<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">            - </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">5010</span></span>
68<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">            - </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">5012</span></span>
69<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">            - </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">5101</span></span>
70<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    condition</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">selection</span></span></code></pre><div class="line-numbers-wrapper" aria-hidden="true"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br><span class="line-number">5</span><br><span class="line-number">6</span><br><span class="line-number">7</span><br><span class="line-number">8</span><br><span class="line-number">9</span><br><span class="line-number">10</span><br><span class="line-number">11</span><br><span class="line-number">12</span><br><span class="line-number">13</span><br><span class="line-number">14</span><br></div></div></div></div><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">EventID IN (</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">5001</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> 5010</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> 5012</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> 5101</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">)</span></span></code></pre></div><!--]--></div><!----></div><div class="tip custom-block"><p class="custom-block-title">In-browser vs. CLI output</p><p>The live query above is the <strong>bare-rule</strong> conversion (no pipeline). The <code>sigma convert</code> command further below adds a target-specific <strong>pipeline</strong> (here Splunk&#39;s built-in <code>splunk_windows</code>), which maps the rule onto the Defender <code>source=</code> and <code>EventCode</code> fields — hence the slightly different output. Each SIEM ships its own pipelines, so the same rule lands correctly on every platform.</p></div><p>Quickly running through this rule, we can describe it as detecting when the field <code>EventID</code> matches the following cases:</p><ul><li>A user has disabled Windows Defender&#39;s Real-time protection <i class="opacity-50 pl-1">or</i> <br>
70<a href="https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide" target="_blank" rel="noreferrer"><code>EventID: 5001</code></a></li><li>A user has disabled Windows Defender&#39;s Anti-Spyware protection <i class="opacity-50 pl-1">or</i> <br><a href="https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide" target="_blank" rel="noreferrer"><code>EventID: 5010</code></a></li><li>A user has disabled Windows Defender&#39;s Anti-Virus protection <i class="opacity-50 pl-1">or</i> <br><a href="https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide" target="_blank" rel="noreferrer"><code>EventID: 5012</code></a></li><li>Windows Defender&#39;s Antimalware platform has expired <br><a href="https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide" target="_blank" rel="noreferrer"><code>EventID: 5101</code></a></li></ul><br><p>After saving the file and closing vim (or your preferred editor), you can use the <code>sigma convert</code> command to convert this Sigma rule into a Splunk query. It&#39;s important to set the correct parameters to ensure a valid query is produced for the SIEM being used in your environment.</p><ul><li><strong>Set the Target SIEM</strong>   <br class="md:hidden"><code>--target splunk</code><br><br class="md:hidden">Use this option to instruct Sigma to convert the Sigma files under the <code>./rules/</code> directory to Splunk SPL.<br><a href="/docs/digging-deeper/backends.html">See the full list of supported backends here -&gt;</a><br><br></li><li><strong>Set the SIEM Pipeline</strong>   <br class="md:hidden"><code>--pipeline splunk_windows</code><br><br class="md:hidden">Use this option to instruct Sigma to use the <code>splunk_windows</code> default field- and source-mapping pipeline.<br><a href="/docs/digging-deeper/pipelines.html">Learn more about Sigma pipelines here -&gt;</a><br><br></li></ul><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-O-64U" id="tab-ydlayRV" checked><label data-title="uvx" for="tab-ydlayRV">uvx</label><input type="radio" name="group-O-64U" id="tab-ZYJwQVV"><label data-title="pip / source" for="tab-ZYJwQVV">pip / source</label></div><div class="blocks"><div class="language-bash vp-adaptive-theme active"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">uvx</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --from</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --with</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> pysigma-backend-splunk</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
71<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --target</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
72<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --pipeline</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk_windows</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
73<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules</span></span></code></pre></div><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span>
73<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
74<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --target</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
75<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --pipeline</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk_windows</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
76<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules</span></span></code></pre></div></div></div><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">source</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;WinEventLog:Microsoft-Windows-Windows Defender/Operational&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> \</span></span>
77<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">EventCode IN (</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">5001</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> 5010</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> 5012</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> 5101</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">)</span></span></code></pre></div><p>Once events are populated under the <code>WinEventLog:Microsoft-Windows-Windows Defender/Operational</code> source within your SIEM – this example being Splunk, you can easily use this query to set up a detection and alert when someone disables Windows Defender within your monitored environment.</p><p>Congratulations, you&#39;re now ready to start detecting security threats using Sigma! 🎉</p><p>You don&#39;t have to start from scratch, either. The community maintains thousands of ready-to-use detections for Windows, Microsoft 365, Okta, AWS, and many more in the <a href="https://github.com/SigmaHQ/sigma/" target="_blank" rel="noreferrer">SigmaHQ/sigma</a> repository.</p><div class="grid gap-4 grid-cols-1 md:grid-cols-2 items-stretch"><a href="/docs/basics/rules.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path d="M11.625 16.5a1.875 1.875 0 1 0 0-3.75 1.875 1.875 0 0 0 0 3.75Z"></path><path fill-rule="evenodd" d="M5.625 1.5H9a3.75 3.75 0 0 1 3.75 3.75v1.875c0 1.036.84 1.875 1.875 1.875H16.5a3.75 3.75 0 0 1 3.75 3.75v7.875c0 1.035-.84 1.875-1.875 1.875H5.625a1.875 1.875 0 0 1-1.875-1.875V3.375c0-1.036.84-1.875 1.875-1.875Zm6 16.5c.66 0 1.277-.19 1.797-.518l1.048 1.048a.75.75 0 0 0 1.06-1.06l-1.
77047-1.048A3.375 3.375 0 1 0 11.625 18Z" clip-rule="evenodd"></path><path d="M14.25 5.25a5.23 5.23 0 0 0-1.279-3.434 9.768 9.768 0 0 1 6.963 6.963A5.23 5.23 0 0 0 16.5 7.5h-1.875a.375.375 0 0 1-.375-.375V5.25Z"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Rules<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Learn more about how each Sigma rule is composed, and how to detect attackers.<!--]--></span></div></a><a href="/docs/digging-deeper/backends.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path fill-rule="evenodd" d="M3 6a3 3 0 0 1 3-3h12a3 3 0 0 1 3 3v12a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3V6Zm14.25 6a.75.75 0 0 1-.22.53l-2.25 2.25a.75.75 0 1 1-1.06-1.06L15.44 12l-1.72-1.72a.75.75 0 1 1 1.06-1.06l2.25 2.25c.141.14.22.331.22.53Zm-10.28-.53a.75.75 0 0 0 0 1.06l2.25 2.25a.75.75 0 1 0 1.06-1.06L8.56 12l1.72-1.72a.75.75 0 1 0-1.06-1.06l-2.25 2.25Z" clip-rule="evenodd"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Backends<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Start to make Sigma work in your own SIEM.<!--]--></span></div></a></div><h3 id="adding-contextual-information" tabindex="-1">Adding Contextual Information <a class="header-anchor" href="#adding-contextual-information" aria-label="Permalink to &quot;Adding Contextual Information&quot;">​</a></h3><p>While the previous example demonstrated a simple detection, in practice, Sigma rules contain additional metadata to provide context for the detection. This metadata may include severity (called &quot;level&quot; within Sigma), references, false-positives, tags (such as MITRE Attack mapping), and a rationale for the detection.</p><p>To better illustrate this point, let&#39;s take a look at a more complex Sigma rule, taken from the <code>SigmaHQ/sigma</code> repository written by <a href="https://twitter.com/TheAustinSonger" target="_blank" rel="noreferrer">Austin Songer</a>.</p><p>This one targets Okta rather than Windows. The format does not change between platforms, and neither does the way you convert it.</p><div class="sigma-converter not-prose my-8" data-v-b4727905><div class="sigma-converter-static" style="" data-v-b4727905><!--[--><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group--6q53" id="tab-AOj-0x8" checked><label data-title="okta_user_account_locked_out.yml" for="tab-AOj-0x8">okta_user_account_locked_out.yml</label></div><div class="blocks"><div class="language-yaml vp-adaptive-theme active line-numbers-mode"><button title="Copy Code" class="copy"></button><span class="lang">yaml</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># rules/identity/okta/okta_user_account_locked_out.yml</span></span>
78<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">title</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Okta User Account Locked Out</span></span>
79<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">id</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a</span></span>
80<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">status</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">test</span></span>
81<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">description</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Detects when an user account is locked out.</span></span>
82<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">references</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
83<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">    - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">https://developer.okta.com/docs/reference/api/system-log/</span></span>
84<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">    - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">https://developer.okta.com/docs/reference/api/event-types/</span></span>
85<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">author</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Austin Songer @austinsonger</span></span>
86<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">date</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">2021-09-12</span></span>
87<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">modified</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">2026-04-27</span></span>
88<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">tags</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
89<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">    - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">attack.impact</span></span>
90<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">    - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">attack.t1531</span></span>
91<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">logsource</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
92<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    product</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">okta</span></span>
93<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    service</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">okta</span></span>
94<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">detection</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
95<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    selection</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
96<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">        displayMessage</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Max sign in attempts exceeded</span></span>
97<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    condition</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">selection</span></span>
98<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">falsepositives</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
99<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">    - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Unknown</span></span>
100<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">level</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">medium</span></span></code></pre><div class="line-numbers-wrapper" aria-hidden="true"><span class="line-number">1</span><br><span class="line-number">2</span><br><span class="line-number">3</span><br><span class="line-number">4</span><br><span class="line-number">5</span><br><span class="line-number">6</span><br><span class="line-number">7</span><br><span class="line-number">8</span><br><span class="line-number">9</span><br><span class="line-number">10</span><br><span class="line-number">11</span><br><span class="line-number">12</span><br><span class="line-number">13</span><br><span class="line-number">14</span><br><span class="line-number">15</span><br><span class="line-number">16</span><br><span class="line-number">17</span><br><span class="line-number">18</span><br><span class="line-number">19</span><br><span class="line-number">20</span><br><span class="line-number">21</span><br><span class="line-number">22</span><br><span class="line-number">23</span><br><span class="line-number">24</span><br></div></div></div></div><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span>
100<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">displaymessage</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;Max sign in attempts exceeded&quot;</span></span></code></pre></div><!--]--></div><!----></div><p>It&#39;s worth noting that Sigma rules often contain fantastic metadata about a detection, which is highly useful when investigating a security incident.</p><div class="info custom-block"><p class="custom-block-title">Learn more about Rules</p><p>To learn more about the fields above and how they are used in Sigma, <br><a href="/docs/basics/rules.html">visit the Rules section of the documentation</a>.</p></div><p>Converting this rule with the Splunk backend and its pipelines produces the query below. Point <code>--target</code> and <code>--pipeline</code> at a different SIEM and the same rule yields a query for that platform instead.</p><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-e-hNq" id="tab-0FluNGT" checked><label data-title="uvx" for="tab-0FluNGT">uvx</label><input type="radio" name="group-e-hNq" id="tab-nQLc7Lw"><label data-title="pip / source" for="tab-nQLc7Lw">pip / source</label></div><div class="blocks"><div class="language-bash vp-adaptive-theme active"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">uvx</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --from</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --with</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> pysigma-backend-splunk</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
101<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --target</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
102<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --pipeline</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk_windows</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
103<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules/cloud/okta/okta_user_account_locked_out.yml</span></span></code></pre></div><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
104<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --target</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
105<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --pipeline</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk_windows</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
106<span class="line highlighted"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules/cloud/okta/okta_user_account_locked_out.yml</span></span></code></pre></div></div></div><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span>
106<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">displaymessage</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;Max sign in attempts exceeded&quot;</span></span></code></pre></div><h3 id="outputting-to-different-formats" tabindex="-1">Outputting to Different Formats <a class="header-anchor" href="#outputting-to-different-formats" aria-label="Permalink to &quot;Outputting to Different Formats&quot;">​</a></h3><p>Notice that adding the metadata to this Sigma rule hasn&#39;t changed the output of this query – using the default output format. Sigma supports outputting to multiple formats, unique to each backend.</p><p>We can see this metadata being used if we change the output format to <code>savedsearches</code>.</p><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-xiXJn" id="tab-Ww0BZOv" checked><label data-title="uvx" for="tab-Ww0BZOv">uvx</label><input type="radio" name="group-xiXJn" id="tab-yna2MNG"><label data-title="pip / source" for="tab-yna2MNG">pip / source</label></div><div class="blocks"><div class="language-bash vp-adaptive-theme active"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># Convert to Splunk savedsearches format</span></span>
107<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">uvx</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --from</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --with</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> pysigma-backend-splunk</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
108<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --format</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> savedsearches</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
109<span class="line highlighted"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --target</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
110<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --pipeline</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk_windows</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
111<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules/cloud/okta/okta_user_account_locked_out.yml</span></span></code></pre></div><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># Convert to Splunk savedsearches format</span></span>
112<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
113<span class="line highlighted"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --format</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> savedsearches</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
114<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --target</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">
114 \</span></span>
115<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    --pipeline</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk_windows</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
116<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules/cloud/okta/okta_user_account_locked_out.yml</span></span></code></pre></div></div></div><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-7Ldrl" id="tab-AJFy9d_" checked><label data-title="Output (savedsearches format)" for="tab-AJFy9d_">Output (savedsearches format)</label></div><div class="blocks"><div class="language-conf vp-adaptive-theme active"><button title="Copy Code" class="copy"></button><span class="lang">conf</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">[default]</span></span>
117<span class="line"><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">dispatch.earliest_time</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> = -30d</span></span>
118<span class="line"><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">dispatch.latest_time</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> = now</span></span>
119<span class="line"></span>
120<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">[Okta User Account Locked Out]</span></span>
121<span class="line"><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">description</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> = Detects when an user account is locked out.</span></span>
122<span class="line"><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">search</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> = </span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">displaymessage</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;Max sign in attempts exceeded&quot;</span></span></code></pre></div></div></div><h3 id="custom-field-source-mapping" tabindex="-1">Custom Field &amp; Source Mapping <a class="header-anchor" href="#custom-field-source-mapping" aria-label="Permalink to &quot;Custom Field &amp; Source Mapping&quot;">​</a></h3><p>Although many logsources in enterprise IT environments are similar, it is essential to recognize that each SIEM is uniquely configured, particularly in its usage of field names, data types, and log formats.</p><p>To address these variances, <code>sigma-cli</code> provides end-users with the ability to perform field-mapping when converting rules. This function ensures any fields found in Sigma rules correctly map to users&#39; fields found within their SIEM.</p><p>To best illustrate the adaptability of the Sigma format, we will onboard a custom logsource (in this example, an internal production service called <code>puppy_app_production</code>) and its corresponding detection rule, into our detections-as-code repository.</p><p>The pipeline below is written for Splunk, since field names and index conventions are specific to each platform. A different SIEM would use its own pipeline while reusing the exact same rule.</p><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># Inside of sigma_test_repo, create a pipelines directory</span></span>
123<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">mkdir</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ./pipelines</span></span>
124<span class="line"></span>
125<span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># Create a new Sigma pipeline file</span></span>
126<span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">vim</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ./pipelines/puppy_app_production_config.yml</span></span></code></pre></div><div class="sigma-converter not-prose my-8" data-v-b4727905><div class="sigma-converter-static" style="" data-v-b4727905><!--[--><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-psCf_" id="tab-dwtRXaE" checked><label data-title="pipelines/puppy_app_production_config.yml" for="tab-dwtRXaE">pipelines/puppy_app_production_config.yml</label><input type="radio" name="group-psCf_" id="tab-O_fWGyQ"><label data-title="rules/sad_puppy.yml" for="tab-O_fWGyQ">rules/sad_puppy.yml</label></div><div class="blocks"><div class="language-yaml vp-adaptive-theme active"><button title="Copy Code" class="copy"></button><span class="lang">yaml</span>
126<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># ./pipelines/puppy_app_production_config.yml</span></span>
127<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">name</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Puppy Application – Splunk Log Source Configuration</span></span>
128<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">priority</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">100</span></span>
129<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">transformations</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
130<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">id</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">prefix_source_and_index_for_puppy_logs</span></span>
131<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    type</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">add_condition</span></span>
132<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    conditions</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
133<span class="line highlighted"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">      index</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;puppy_prod&quot;</span></span>
134<span class="line highlighted"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">      source</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;PuppyApp/App&quot;</span></span>
135<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    rule_conditions</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
136<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">      - </span><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">type</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">logsource</span></span>
137<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">        product</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">puppy</span></span>
138<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">        service</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">app</span></span>
139<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">id</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">map_fields_for_puppies</span></span>
140<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    type</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">field_name_mapping</span></span>
141<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    mapping</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
142<span class="line highlighted"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">      status</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;puppy.status&quot;</span></span>
143<span class="line highlighted"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">      dog_name</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;puppy.name&quot;</span></span>
144<span class="line highlighted"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">      dog_breed</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;puppy.breed&quot;</span></span>
145<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    rule_conditions</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
146<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">      - </span><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">type</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">logsource</span></span>
147<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">        product</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">puppy</span></span>
148<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">        service</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">app</span></span></code></pre></div><div class="language-yaml vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">yaml</span>
148<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6A737D;--shiki-dark:#6A737D;"># ./rules/sad_puppy.yml</span></span>
149<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">title</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Sad Puppy in Dog Supply Line</span></span>
150<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">id</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">469b8469-508d-42d0-98a1-0c7e937ca7a3</span></span>
151<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">status</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">experimental</span></span>
152<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">description</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">&gt;</span></span>
153<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">  Detects whenever a sad puppy is logged to the Dog Supply Line (DSL) log stream output.</span></span>
154<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">  See wiki on how to triage with treats and/or walks.</span></span>
155<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">references</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
156<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">https://wiki.example.com/DOG/Sad+Puppy+Playbook+(2023)</span></span>
157<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">author</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">Toto &lt;[email protected]&gt;</span></span>
158<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">date</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">2023-04-06</span></span>
159<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">logsource</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
160<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">  product</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">puppy</span></span>
161<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">  service</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">app</span></span>
162<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">detection</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
163<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">  selection</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
164<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">    status</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;sad&quot;</span></span>
165<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">  condition</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">selection</span></span>
166<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">fields</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
167<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">dog_name</span></span>
168<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">dog_breed</span></span>
169<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">status</span></span>
170<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">falsepositives</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">:</span></span>
171<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">  - </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">sometimes sad dogs are reported as guilting owners for walks, treats etc.</span></span>
172<span class="line"><span style="--shiki-light:#22863A;--shiki-dark:#85E89D;">level</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">: </span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">high</span></span></code></pre></div></div></div><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span>
172<pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">index</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;puppy_prod&quot;</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> source</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;PuppyApp/App&quot;</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> puppy.status</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;sad&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> |</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> table</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> puppy.name,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">puppy.breed</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,puppy.status</span></span></code></pre></div><!--]--></div><!----></div><p>In the above configuration example, any rules that have a match on the following:<br><code>product: puppy</code> and <code>service: app</code>, Sigma will apply</p><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">index</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&#39;puppy_prod&#39;</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> source</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&#39;PuppyApp/App&#39;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> ...</span></span></code></pre></div><p>to the resultant SIEM query output, and map each field across, for example <code>status</code> to <code>puppy.status</code>, <code>dog_name</code> to <code>puppy.name</code> etc.</p><p>We can combine this configuration example with the custom <code>sad_puppy.yml</code> detection rule, that will detect whenever our log source detects a sad puppy in our SIEM.</p><div class="vp-code-group vp-adaptive-theme"><div class="tabs"><input type="radio" name="group-R7yGa" id="tab-jIyYVit" checked><label data-title="uvx" for="tab-jIyYVit">uvx</label><input type="radio" name="group-R7yGa" id="tab-OBGfRMK"><label data-title="pip / source" for="tab-OBGfRMK">pip / source</label></div><div class="blocks"><div class="language-bash vp-adaptive-theme active"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">uvx</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --from</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma-cli</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> --with</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> pysigma-backend-splunk</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
173<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    -t</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
174<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    -p</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ./pipelines/puppy_app_production_config.yml</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">
174 \</span></span>
175<span class="line highlighted"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules/sad_puppy.yml</span></span></code></pre></div><div class="language-bash vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">bash</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#6F42C1;--shiki-dark:#B392F0;">sigma</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> convert</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
176<span class="line"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    -t</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> splunk</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
177<span class="line highlighted"><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;">    -p</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;"> ./pipelines/puppy_app_production_config.yml</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> \</span></span>
178<span class="line"><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">    ./rules/sad_puppy.yml</span></span></code></pre></div></div></div><div class="language-splunk vp-adaptive-theme"><button title="Copy Code" class="copy"></button><span class="lang">splunk</span><pre class="shiki shiki-themes github-light github-dark vp-code" tabindex="0"><code><span class="line"><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">index</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;puppy_prod&quot;</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> source</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;PuppyApp/App&quot;</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;"> puppy.status</span><span style="--shiki-light:#D73A49;--shiki-dark:#F97583;">=</span><span style="--shiki-light:#032F62;--shiki-dark:#9ECBFF;">&quot;sad&quot;</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> </span></span>
179<span class="line"><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">|</span><span style="--shiki-light:#005CC5;--shiki-dark:#79B8FF;"> table</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;"> puppy.name,</span><span style="--shiki-light:#E36209;--shiki-dark:#FFAB70;">puppy.breed</span><span style="--shiki-light:#24292E;--shiki-dark:#E1E4E8;">,puppy.status</span></span></code></pre></div><p>Most supported SIEMs ship with their fields and log sources already mapped, so you rarely write a pipeline from scratch. Pipelines handle the mapping; log sources describe what your rules match against.</p><div class="grid gap-4 grid-cols-1 md:grid-cols-2 items-stretch"><a href="/docs/digging-deeper/pipelines.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path d="M11.25 5.337c0-.355-.186-.676-.401-.959a1.647 1.647 0 0 1-.349-1.003c0-1.036 1.007-1.875 2.25-1.875S15 2.34 15 3.375c0 .369-.128.713-.349 1.003-.215.283-.401.604-.401.959 0 .332.278.598.61.578 1.91-.114 3.79-.342 5.632-.676a.75.75 0 0 1 .878.645 49.17 49.17 0 0 1 .376 5.452.657.657 0 0 1-.66.664c-.354 0-.675-.186-.958-.401a1.647 1.647 0 0 0-1.003-.349c-1.035 0-1.875 1.007-1.875 2.25s.84 2.25 1.875 2.25c.369 0 .713-.128 1.003-.349.283-.215.604-.401.959-.401.31 0 .557.262.534.571a48.774 48.774 0 0 1-.595 4.845.75.75 0 0 1-.61.61c-1.82.317-3.673.533-5.555.642a.58.58 0 0 1-.611-.581c0-.355.186-.676.401-.959.221-.29.349-.634.349-1.003 0-1.035-1.007-1.875-2.25-1.875s-2.25.84-2.25 1.875c0 .369.128.713.349 1.003.215.283.401.604.401.959a.641.641 0 0 1-.658.643 49.118 49.118 0 0 1-4.708-.36.75.75 0 0 1-.645-.878c.293-1.614.504-3.257.629-4.924A.53.53 0 0 0 5.337 15c-.355 0-.676.186-.959.401-.29.221-.634.349-1.003.349-1.036 0-1.875-1.007-1.875-2.25s.84-2.25 1.875-2.25c.369 0 .713.128 1.003.349.283.215.604.401.959.401a.656.656 0 0 0 .659-.663 47.703 47.703 0 0 0-.31-4.82.75.75 0 0 1 .83-.832c1.343.155 2.703.254 4.077.294a.64.64 0 0 0 .657-.642Z"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Pipelines<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Start to write your own Sigma conversion logic.<!--]--></span></div></a><a href="/docs/basics/log-sources.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path fill-rule="evenodd" d="M3 6.75A.75.75 0 0 1 3.75 6h16.5a.75.75 0 0 1 0 1.5H3.75A.75.75 0 0 1 3 6.75ZM3 12a.75.75 0 0 1 .75-.75H12a.75.75 0 0 1 0 1.5H3.75A.75.75 0 0 1 3 12Zm0 5.25a.75.75 0 0 1 .75-.75h16.5a.75.75 0 0 1 0 1.5H3.75a.75.75 0 0 1-.75-.75Z" clip-rule="evenodd"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Logsources<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Learn how to tune your Sigma rules for specific sets of logs.<!--]--></span></div></a></div><h2 id="what-s-next" tabindex="-1">What&#39;s Next? <a class="header-anchor" href="#what-s-next" aria-label="Permalink to &quot;What&#39;s Next?&quot;">​</a></h2><p>You now have the essentials: writing a rule, converting it for any SIEM, and tailoring the output with pipelines. The pages below go deeper on each part of Sigma.</p><div class="grid gap-4 grid-cols-1 md:grid-cols-2 items-stretch"><a href="/docs/basics/rules.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path d="M11.625 16.5a1.875 1.875 0 1 0 0-3.75 1.875 1.875 0 0 0 0 3.75Z"></path><path fill-rule="evenodd" d="M5.625 1.5H9a3.75 3.75 0 0 1 3.75 3.75v1.875c0 1.036.84 1.875 1.875 1.875H16.5a3.75 3.75 0 0 1 3.75 3.75v7.875c0 1.035-.84 1.875-1.875 1.875H5.625a1.875 1.875 0 0 1-1.875-1.875V3.375c0-1.036.84-1.875 1.875-1.875Zm6 16.5c.66 0 1.277-.19 1.797-.518l1.048 1.048a.75.75 0 0 0 1.06-1.06l-1.
179047-1.048A3.375 3.375 0 1 0 11.625 18Z" clip-rule="evenodd"></path><path d="M14.25 5.25a5.23 5.23 0 0 0-1.279-3.434 9.768 9.768 0 0 1 6.963 6.963A5.23 5.23 0 0 0 16.5 7.5h-1.875a.375.375 0 0 1-.375-.375V5.25Z"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Rules<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Learn more about how each Sigma rule is composed, and how to detect attackers.<!--]--></span></div></a><a href="/docs/basics/log-sources.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path fill-rule="evenodd" d="M3 6.75A.75.75 0 0 1 3.75 6h16.5a.75.75 0 0 1 0 1.5H3.75A.75.75 0 0 1 3 6.75ZM3 12a.75.75 0 0 1 .75-.75H12a.75.75 0 0 1 0 1.5H3.75A.75.75 0 0 1 3 12Zm0 5.25a.75.75 0 0 1 .75-.75h16.5a.75.75 0 0 1 0 1.5H3.75a.75.75 0 0 1-.75-.75Z" clip-rule="evenodd"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Logsources<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Learn how to tune your Sigma rules for specific sets of logs.<!--]--></span></div></a><a href="/docs/digging-deeper/backends.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path fill-rule="evenodd" d="M3 6a3 3 0 0 1 3-3h12a3 3 0 0 1 3 3v12a3 3 0 0 1-3 3H6a3 3 0 0 1-3-3V6Zm14.25 6a.75.75 0 0 1-.22.53l-2.25 2.25a.75.75 0 1 1-1.06-1.06L15.44 12l-1.72-1.72a.75.75 0 1 1 1.06-1.06l2.25 2.25c.141.14.22.331.22.53Zm-10.28-.53a.75.75 0 0 0 0 1.06l2.25 2.25a.75.75 0 1 0 1.06-1.06L8.56 12l1.72-1.72a.75.75 0 1 0-1.06-1.06l-2.25 2.25Z" clip-rule="evenodd"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Backends<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Start to make Sigma work in your own SIEM.<!--]--></span></div></a><a href="/docs/digging-deeper/pipelines.html"><div class="box group relative z-10 flex h-full w-full flex-col rounded-lg bg-[#E3F2FA]/40 p-6 text-white outline outline-2 outline-[#C6D2ED]/40 transition-all hover:bg-[#DEF5FC] hover:outline-2 hover:outline-offset-2 hover:outline-[#AAD0EC] dark:bg-[#252C3B]/25 dark:outline-[#383C5E]/50 dark:hover:bg-[#37455E]/40 dark:hover:outline-[var(--vp-c-brand-1)]"><span class="box-icon mb-4 flex h-10 w-10 items-center justify-center rounded-full bg-transparent text-slate-700 outline outline-1 outline-[#C6D2ED]/70 transition-all group-hover:bg-[var(--vp-c-brand-1)] group-hover:text-white group-hover:outline-[var(--vp-c-brand-1)] dark:text-[var(--vp-c-brand-1)] dark:outline-slate-400/30 dark:group-hover:text-white"><!--[--><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true" data-slot="icon"><path d="M11.25 5.337c0-.355-.186-.676-.401-.959a1.647 1.647 0 0 1-.349-1.003c0-1.036 1.007-1.875 2.25-1.875S15 2.34 15 3.375c0 .369-.128.713-.349 1.003-.215.283-.401.604-.401.959 0 .332.278.598.61.578 1.91-.114 3.79-.342 5.632-.676a.75.75 0 0 1 .878.645 49.17 49.17 0 0 1 .376 5.452.657.657 0 0 1-.66.664c-.354 0-.675-.186-.958-.401a1.647 1.647 0 0 0-1.003-.349c-1.035 0-1.875 1.007-1.875 2.25s.84 2.25 1.875 2.25c.369 0 .713-.128 1.003-.349.283-.215.604-.401.959-.401.31 0 .557.262.534.571a48.774 48.774 0 0 1-.595 4.845.75.75 0 0 1-.61.61c-1.82.317-3.673.533-5.555.642a.58.58 0 0 1-.611-.581c0-.355.186-.676.401-.959.221-.29.349-.634.349-1.003 0-1.035-1.007-1.875-2.25-1.875s-2.25.84-2.25 1.875c0 .369.128.713.349 1.003.215.283.401.604.401.959a.641.641 0 0 1-.658.643 49.118 49.118 0 0 1-4.708-.36.75.75 0 0 1-.645-.878c.293-1.614.504-3.257.629-4.924A.53.53 0 0 0 5.337 15c-.355 0-.676.186-.959.401-.29.221-.634.349-1.003.349-1.036 0-1.875-1.007-1.875-2.25s.84-2.25 1.875-2.25c.369 0 .713.128 1.003.349.283.215.604.401.959.401a.656.656 0 0 0 .659-.663 47.703 47.703 0 0 0-.31-4.82.75.75 0 0 1 .83-.832c1.343.155 2.703.254 4.077.294a.64.64 0 0 0 .657-.642Z"></path></svg><!--]--></span><span class="text-d m-0 p-0 font-bold text-[#161821] dark:text-white"><!--[-->Pipelines<!--]--></span><span class="text-d m-0 p-0 text-sm text-[#7280A0] dark:text-slate-500"><!--[-->Start to write your own Sigma conversion logic.<!--]--></span></div></a></div></div></div></main><footer class="VPDocFooter" data-v-e6f2a212 data-v-1bcd8184><!--[--><!--]--><div class="edit-info" data-v-1bcd8184><div class="edit-link" data-v-1bcd8184><a class="VPLink link vp-external-link-icon no-icon edit-link-button" href="https://github.com/SigmaHQ/sigmahq.g
179ithub.io/edit/main/docs/guide/getting-started.md" target="_blank" rel="noreferrer" data-v-1bcd8184><!--[--><span class="vpi-square-pen edit-link-icon" data-v-1bcd8184></span> Edit on GitHub<!--]--></a></div><div class="last-updated" data-v-1bcd8184><p class="VPLastUpdated" data-v-1bcd8184 data-v-1bb0c8a8>Last updated: <time datetime="2026-06-16T09:07:55.000Z" data-v-1bb0c8a8></time></p></div></div><nav class="prev-next" aria-labelledby="doc-footer-aria-label" data-v-1bcd8184><span class="visually-hidden" id="doc-footer-aria-label" data-v-1bcd8184>Pager</span><div class="pager" data-v-1bcd8184><a class="VPLink link pager-link prev" href="/docs/guide/about.html" data-v-1bcd8184><!--[--><span class="desc" data-v-1bcd8184>Previous page</span><span class="title" data-v-1bcd8184>About Sigma</span><!--]--></a></div><div class="pager" data-v-1bcd8184><a class="VPLink link pager-link next" href="/docs/guide/faq.html" data-v-1bcd8184><!--[--><span class="desc" data-v-1bcd8184>Next page</span><span class="title" data-v-1bcd8184>FAQs</span><!--]--></a></div></nav></footer><!--[--><!--]--></div></div></div><!--[--><!--]--></div></div><footer class="VPFooter has-sidebar" data-v-d8b57b2d data-v-566314d4><div class="container" data-v-566314d4><!----><p class="copyright" data-v-566314d4>Copyright © 2020-present SigmaHQ</p></div></footer><!--[--><!--]--></div></div>
180    
180<script>window.__VP_HASH_MAP__=JSON.parse("{\"docs_basics_conditions.md\":\"69mJ3yOE\",\"docs_basics_log-sources.md\":\"Cxl7xwJc\",\"docs_basics_modifiers.md\":\"bek2_Hhm\",\"docs_basics_rules.md\":\"CO2uzLqP\",\"docs_digging-deeper_backends.md\":\"DopgqRqm\",\"docs_digging-deeper_contributing.md\":\"Dq7B9n-r\",\"docs_digging-deeper_convert.md\":\"fQMLM5L6\",\"docs_digging-deeper_pipelines.md\":\"ntW4-NzB\",\"docs_digging-deeper_pipelines__conditions.md\":\"BukUALY-\",\"docs_digging-deeper_pipelines__finalizers.md\":\"BHaLXgca\",\"docs_digging-deeper_pipelines__placeholders.md\":\"DlOS_dom\",\"docs_digging-deeper_pipelines__postprocessing.md\":\"C94numY_\",\"docs_digging-deeper_pipelines__priorities.md\":\"DDgNvfFM\",\"docs_digging-deeper_pipelines__transformations.md\":\"DkWd-BO8\",\"docs_digging-deeper_pipelines__vars_state.md\":\"C8vHJ1R_\",\"docs_guide_about.md\":\"DOJ2v1nh\",\"docs_guide_faq.md\":\"CzepWrRE\",\"docs_guide_getting-started.md\":\"Bp3-SdKr\",\"docs_index.md\":\"D9kZ5C68\",\"docs_meta_correlations.md\":\"DV8maoox\",\"docs_meta_filters.md\":\"CxLoc2XP\",\"docs_meta_index.md\":\"B8VUCH3b\",\"index.md\":\"B-Hhs-9Y\",\"resources_index.md\":\"eEEbxXyN\",\"resources_media.md\":\"CMVgnG7d\"}");window.__VP_SITE_DATA__=JSON.parse("{\"lang\":\"en-US\",\"dir\":\"ltr\",\"title\":\"Sigma\",\"titleTemplate\":\"Sigma Detection Format\",\"description\":\"A generic and open signature format that allows you to describe relevant log events in a straight-forward manner.\",\"base\":\"/\",\"head\":[],\"router\":{\"prefetchLinks\":true},\"appearance\":true,\"themeConfig\":{\"logo\":{\"dark\":\"/images/logo.svg\",\"light\":\"/images/logo_light.svg\"},\"outline\":[2,4],\"nav\":[{\"text\":\"Documentation\",\"activeMatch\":\"/docs/\",\"link\":\"/docs/guide/getting-started.html\"},{\"text\":\"Rules\",\"link\":\"https://github.com/SigmaHQ/sigma\"},{\"text\":\"Blog\",\"link\":\"https://medium.com/sigma-hq\"},{\"text\":\"Misc\",\"items\":[{\"text\":\"Sigma Specification\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/\"},{\"text\":\"Changelog\",\"link\":\"https://github.com/SigmaHQ/sigmahq.github.io\"}]}],\"sidebar\":{\"/\":[{\"text\":\"Introduction\",\"items\":[{\"text\":\"About Sigma\",\"link\":\"/docs/guide/about\"},{\"text\":\"Getting Started\",\"link\":\"/docs/guide/getting-started\"},{\"text\":\"FAQs\",\"link\":\"/docs/guide/faq\"}]},{\"text\":\"Sigma Basics\",\"items\":[{\"text\":\"Rules\",\"link\":\"/docs/basics/rules\"},{\"text\":\"Modifiers\",\"link\":\"/docs/basics/modifiers\"},{\"text\":\"Conditions\",\"link\":\"/docs/basics/conditions\"},{\"text\":\"Log Sources\",\"link\":\"/docs/basics/log-sources\"}]},{\"text\":\"Meta Rules\",\"link\":\"/docs/meta/\",\"items\":[{\"text\":\"Correlations\",\"link\":\"/docs/meta/correlations\"},{\"text\":\"Filters\",\"link\":\"/docs/meta/filters\"}]},{\"text\":\"Digging Deeper\",\"items\":[{\"text\":\"Backends\",\"link\":\"/docs/digging-deeper/backends\"},{\"text\":\"Pipelines\",\"link\":\"/docs/digging-deeper/pipelines\"},{\"text\":\"Contributing\",\"link\":\"/docs/digging-deeper/contributing\"}]},{\"text\":\"Backends\",\"items\":[{\"text\":\"Elasticsearch\",\"link\":\"https://github.com/SigmaHQ/pySigma-backend-elasticsearch\",\"rel\":\"_target\"},{\"text\":\"Splunk\",\"link\":\"https://github.com/SigmaHQ/pySigma-backend-splunk\",\"rel\":\"_target\"},{\"text\":\"Grafana Loki\",\"link\":\"https://github.com/grafana/pySigma-backend-loki\",\"rel\":\"_target\"},{\"text\":\"Azure Sentinel / Microsoft 365 Defender\",\"link\":\"https://github.com/AttackIQ/pySigma-backend-microsoft365defender\",\"rel\":\"_target\"},{\"text\":\"CrowdStrike Falcon LogScale \",\"link\":\"https://github.com/SigmaHQ/pySigma-backend-crowdstrike\",\"rel\":\"_target\"},{\"text\":\"More  ›\",\"link\":\"/docs/digging-deeper/backends.html\"}]},{\"text\":\"Ecosystem\",\"collapsed\":true,\"items\":[{\"text\":\"Sigma Rules Main Repo\",\"link\":\"https://github.com/SigmaHQ/sigma\"},{\"text\":\"Sigma Rule Packages\",\"link\":\"https://github.com/SigmaHQ/sigma/releases\"},{\"text\":\"pySigma\",\"link\":\"https://github.com/SigmaHQ/pySigma\"},{\"text\":\"Sigma CLI\",\"link\":\"https://github.com/SigmaHQ/sigma-cl
180i\"}]},{\"text\":\"Specification\",\"collapsed\":true,\"items\":[{\"text\":\"Sigma Rules\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-rules-specification.md\"},{\"text\":\"Sigma Correlations\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md\"},{\"text\":\"Sigma Filters\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-filters-specification.md\"},{\"text\":\"Sigma Modifiers Appendix\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-modifiers-appendix.md\"},{\"text\":\"Sigma Tags Appendix\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-tags-appendix.md\"},{\"text\":\"Sigma Taxonomy Appendix\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/blob/main/appendix/sigma-taxonomy-appendix.md\"},{\"text\":\"SigmaHQ Conventions\",\"link\":\"https://github.com/SigmaHQ/sigma-specification/tree/main/sigmahq\"}]}]},\"footer\":{\"copyright\":\"Copyright © 2020-present SigmaHQ\"},\"editLink\":{\"pattern\":\"https://github.com/SigmaHQ/sigmahq.github.io/edit/main/:path\",\"text\":\"Edit on GitHub\"},\"socialLinks\":[{\"icon\":\"discord\",\"link\":\"https://discord.gg/kQQBn5W2z5\"},{\"icon\":\"twitter\",\"link\":\"https://twitter.com/Sigma_HQ/\"},{\"icon\":\"github\",\"link\":\"https://github.com/SigmaHQ/sigma\"}],\"search\":{\"provider\":\"local\",\"options\":{}}},\"locales\":{},\"scrollOffset\":134,\"cleanUrls\":false}");</script>
180
181    
182  </body>
183</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.