SigmaHQ/sigma
Sigma
Sigma is a suite of tools for defining generic log signatures and translating them for multiple backends. It provides a structured way to define malicious behavior and detection logic independently of any specific backend technology, acting as a translation engine that maps generic event fields and correlation logic to the proprietary query languages of security data lakes and SIEM platforms.
The project features a plugin-based multi-backend query generator that exports security detections into various database and log management formats. It also includes a threat framework mapping tool that generates coverage heatmaps by linking detection rule metadata to established security threat frameworks.
The system covers security log normalization, multi-stage attack correlation, and log-to-rule generation. It further supports the export of detection rules into threat intelligence platforms to centralize indicators and security logic.
Features
- Query Translation Layers - Translates generic security detection rules into proprietary query languages for various SIEM and log management platforms.
- SIEM - Converts standardized log-detection rules into proprietary query languages for various SIEM platforms.
- SIEM Rule Converters - Translates standardized security detection signatures into search queries for various SIEM and logging platforms.
- Detection Engineering - Uses a structured, standardized format to describe malicious behavior consistently across different log files.
- Security Event Correlation - Identifies complex attack sequences by specifying patterns where multiple events trigger within a set timeframe.
- Security Analytics Platforms - Maps generic event fields and correlation logic to the proprietary query languages of security data lakes.
- Schema Definition Languages - Employs a standardized YAML-based language to define detection logic independently of specific logging platforms.
- Log Field Mappings - Provides a translation layer that maps generic log fields to platform-specific identifiers across diverse data sources.
- Log-to-Signature Generators - Automatically creates formal detection signatures by converting provided log entries into structured rules.
- Framework Coverage Mapping - Associates detection rules with external security frameworks by scanning metadata tags to generate coverage heatmaps.
- Multi-Backend Query Generators - Exports security detections into multiple different database and log management formats via a plugin-based converter.
- Query Generation Patterns - Constructs complex search strings by iterating through logic operators defined in a standardized rule schema.
- Plugin Systems - Provides a flexible plugin system for adding new security platform targets and customizing data conversion.
- Coverage Heatmaps - Provides a utility to generate visual coverage heatmaps by linking detection rule metadata to established security threat frameworks.
- Detection Coverage Heatmaps - Creates a visual heatmap of security coverage by mapping rule tags to threat frameworks.
- Intermediate Representations - Implements an internal representation that bridges high-level detection logic and final backend-specific query formats.
- Plugin-Based Architectures - Uses a modular plugin architecture to map generic detection signatures to target-specific query syntaxes.
- Detection Rules and Analytics - Generic signature format for SIEM systems.
- Log Analysis Tools - Generic signature format for SIEM detection rules.
- Threat Intelligence - Standardized signature format for security information and event management.
- Detection Content Libraries - Provides a universal, platform-agnostic format for detection content.
- Advanced Threat Analysis - Generic signature format for log-based threat detection.
- Signature Rules - Generic signature format for detecting malicious events in logs.
