Sigma rules are detection rules written in an open, vendor-neutral format for log data. A Sigma rule describes which log events indicate suspicious behavior, and converters translate it into the query language of a specific SIEM or log platform.

How it works

• Each rule is a YAML file with a title, description, references and a severity level.
• A log source section states which logs the rule applies to, such as process creation on Windows or web server logs.
• A detection section lists the field values to match and the condition that combines them.
• Tags often link the rule to MITRE ATT&CK techniques.

Because the rule is written once and converted many times, teams can share detections across different tools. A rule only works if the right logs are collected: a rule written for one log source will not fire on another.

Why it matters for defenders

Agencies and researchers increasingly publish Sigma rules with their advisories, next to YARA rules for files and lists of indicators of compromise. That lets a SOC move quickly from a report about a new campaign to a working search in its own logs. Sigma rules also give threat hunting results a durable form, so a successful hunt becomes a permanent detection.

Sources: NCSC: Cyber Incident Response, Enhanced Level Working Practices, CISA Malware Analysis Report AR25-261A