sigma-writing

What problem does it solve?

SIGMA Rule Writing Guide explains how to express threat-detection logic in a vendor-agnostic YAML format that can be deployed across multiple SIEM platforms.

Core Features & Use Cases

• Describes the standard SIGMA rule structure (title, id, description, references, author, date, logsource, detection, level) and how to map detections to ATT&CK techniques.
• Demonstrates how to write, version, and validate rules for cross-platform detection, incident response, and proactive threat hunting.
• Provides practical examples and best practices to ensure portable, testable detections across security stacks.

Quick Start

Create a Sigma rule that detects Windows process_creation events and test it against a benign event sample.