thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Sigma

A generic, vendor-neutral signature format for writing log-based detection rules that convert to SIEM queries.

Definition

Sigma rules are written in YAML with logsource, detection and condition fields, and are converted with tools such as pySigma or sigma-cli into SPL, KQL, EQL and other query languages. A large community repository maps rules to ATT&CK techniques.

Example

A Sigma rule detecting rundll32.exe executing without arguments, converted to a Splunk search.

Exam tip

Sigma is to logs what YARA is to files and Snort is to network traffic.

Related terms