Sigma
Sigma — Generic Detection Rule Format
Generisches Format für Erkennungsregeln
Sigma is an open, vendor-neutral format for describing detection rules for log data — essentially what YARA — Pattern Matching for Malware (YARA) is for files, applied to log events. A rule written in Sigma can be translated via tooling into the query language of various Security Information and Event Management (SIEM) systems. This makes detection logic portable and shareable independently of the concrete product.
History & facts. Before Sigma, detection logic was locked into the respective proprietary Security Information and Event Management (SIEM) language — a good rule could not easily be shared with others or transferred to another system. Sigma describes rules in a simple, readable YAML format and leaves translation into the target language to a converter. A maintained, public rule base lets the community quickly make new attack techniques available as shared detection.
Outlook & recommendation. Sigma fits closely with Adversarial Tactics, Techniques & Common Knowledge (ATT&CK): rules can be mapped to concrete techniques, making coverage gaps visible. For organisations with a heterogeneous or changing Security Information and Event Management (SIEM) landscape, vendor independence is a strategic advantage — the detection logic invested is preserved across a platform change. Shared Sigma rules are also a practical way to benefit from others' experience.