sigma-specification

Sigma Specification - Generic Signature Format for SIEM Systems

</a>

Welcome to the official Sigma Specification repository.

A Quick Rundown

Here’s what you can expect from each of the main subfolders within this repo. Please take a minute to educate yourself!

Specification

Specification will contain markdown files describing the Sigma specification format in details.

• Sigma Rules Specification - Describes what constitute a Sigma rule.
• Sigma Correlation Specification - Describes the Sigma correlation format.
• Sigma Filters Specification - Described the Sigma filters format.

JSON Schema

Json-Schema will contain a list of JSON schemas for the following.

• Sigma Rules
• Sigma Correlation Rules
• Sigma Filters

Appendix

Appendix will contain additional files providing additional details to certain fields of a Sigma rule

• Sigma Modifiers Appendix is a document that defines the different modifiers that can be used in a Sigma rule.
• Sigma Tags Appendix is a document that defines the tags namespaces that can be used to categorize the different Sigma rules.
• Sigma Taxonomy Appendix is a document that defines the different field names and log sources that are currently supported by SigmaHQ in order to ensure sharable rules.

SigmaHQ

SigmaHQ will contain markdown files that describe rules and recommendations that are applied to the rules hosted in SigmaHQ main rule repository.

Note

The SigmaHQ folder and the files contains within are not part of the sigma specification. They are there to ensure and easier management of the rules hosted in the main rule repository

• SigmaHQ Rule Convention
• SigmaHQ Filename Convention
• SigmaHQ Title Convention

Version 2 Changes

You can read more on the potential breaking changes and additional features introduced in version 2.0.0 of the specification here

This site is open source. Improve this page.