This repository is used to maintain the specification for the Sigma format.

Web version

Version Management

The version number is in the form of 3 digits ‘A.B.C’:

Current Version

The Sigma format specifications is described in the file Sigma_specification

There exists two other files in the repository to describe the different fields and tags to be used in Sigma rules:

Work in Progress

This section lists upcoming developments and changes to the standard. Please note:

Do not hesitate to open a discussion with tag V2 in the title. Example V2 proposal of new modifier X.

For more information, check the version_2 branch

Archive of Old Specifications

Local copy sigmahq Specification wiki 2022/09/24 or the online sigmahq Specification wiki


The following files are not part of the sigma specification. They are only helpers for the management of the main rule repository

SigmaHQ Filename Normalisation