SigmaHQ/sigma
Main Sigma Rule Repository
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
No releases in the last 90 days; the most recent was 117 days ago, with 348 contributors on GitHub.
Gained 27% more stars in the last 90 days than in the 90 days before.
Use Cases & Benefits
- Provides a generic, open signature format for describing and sharing log-based detection rules across SIEM systems.
- Enables vendor-agnostic, standardized, and easily shareable detection rules to improve collaborative threat detection.
- Use for creating and sharing threat-agnostic detection rules to identify suspicious behaviors in log data.
- Use for threat hunting by leveraging broad-scope rules to investigate potential malicious activities.
- Use for timely detection of emerging threats including specific APT campaigns and zero-day exploitations.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Other
GitHub could not identify this license; read the LICENSE file before depending on it.
Community files
- README: present
- Contributing guide: present
Watch-outs
- License not identified by GitHub; read the LICENSE file before depending on it.
General guidance from repository metadata, not legal advice. How we score
From the README
Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims to make reliable detections accessible to all at no cost.
To start exploring the Sigma ecosystem, please visit the official website sigmahq.io
Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file.
The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others.
Sigma is for log files what Snort is for network traffic and YARA is for files.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
2.9K+177
Open issues
322+138
Compared with peers in Observability
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 8, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| Asymptote-Labs/agent-beacon | 3.4K | +315 | 75 | 1 day ago |
| VictoriaMetrics/VictoriaMetrics | 18.1K | +70 | 75 | 1 day ago |
| jaegertracing/jaeger | 23.4K | — | 65 | 4 days ago |
| vectordotdev/vector | 22.8K | — | 64 | 11 days ago |
| amir20/dozzle | 14.9K | — | 40 | today |
| SigmaHQ/sigma | 11.4K | — | 54 | 117 days ago |
| Category median | 18.1K | +193 | 65 | — |
Discover Repositories
Search across tracked repositories by name or description