A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
simple webapp for converting sigma rules into siem queries using the pySigma library
A reactJS web app that can take a ruleset and translate it into any SIEM search query, using Sigma
Detection-as-code for OT/ICS: Sigma + native Suricata rules, dependency-free Rust DNP3/S7comm/OPC UA decoders, ATT&CK for ICS coverage, purple-team validation and multi-SIEM conversion.
pySigma backend that converts Sigma detection rules to LogsQL queries for VictoriaLogs
Convert Sigma detections (pySigma) into Wazuh 4.x analysisd XML. Honest skips, persistent SIDs, no vendored SigmaHQ rules.
pySigma backend for Sumo Logic Cloud SIEM rule conversion
Detection-as-code pipeline with measured precision/recall against OTRF captures. 20 Sigma rules, multi-SIEM (SPL/EQL/KQL), ATT&CK coverage, two logsource baselines. By Aadarsh Kadam.
Reglas Sigma de detección mapeadas a MITRE ATT&CK, validadas y convertibles a queries reales con pySigma
Offline detection-as-code lab for original Sigma rules, synthetic behavioral tests, ATT&CK mapping, coverage analysis, and pySigma query conversion.
Sigma rules, tested on public attack logs and clean baselines, with ADS detection cards
pySigma backend for Varpulis VPL: Sigma rules, correlation rules included, as detection streams
Detection Matchability Analyzer - finds the Sigma rules that can never match your real post-pipeline data, explains why, and generates the minimal event that would prove each one can fire.
Detection rules managed like code. 41 Sigma rules are linted, backtested, and voted on by three AI models before they can deploy to Elastic, so a broken or noisy rule gets caught in review instead of in your SIEM. Each rule is tagged with the MITRE ATT&CK technique it detects and the NIST 800-53 and CIS v8 controls it supports.
Fixture-validated Sigma detections compiled for Elastic and CrowdStrike LogScale with evidence manifests, CI, and documented validation boundaries.
Detection-as-code: 41 Sigma rules linted, unit-tested and regression-tested against public ATT&CK recordings, converted to SPL/Elastic/KQL, with an ATT&CK coverage layer.
Detection engineering tool: load JSONL datasets, write Sigma rules, run them against OpenSearch, track findings and experiments.
To associate your repository with the pysigma topic, visit your repo's landing page and select "manage topics."