Sigma Project News

The update opens with a new central landing page for the Sigma project, which replaces resources that were previously spread across several GitHub repositories. It gathers documentation, rule repositories and related projects in one place, and short convenience domains point directly to the rules and to a route for reporting false positives. A project blog that has run for a few months carries general news and how-to articles on using Sigma and its converter.

The main change is a set of regular rule packages, released about every two weeks, added after feedback that the full repository produced too many false positives. A core package holds only high and critical severity rules that are marked stable. Core-plus and core-plus-plus packages need tuning before they are used operationally, an emerging threats add-on is organized by year, and an all-rules package contains everything at release state. The Sigma CLI also gained query post-processing, which uses a templating engine to add rule metadata, scheduling or search-window settings around generated output such as Splunk searches.

Finally, a web-based open-source Sigma converter has been released. It is built on pySigma and includes the processing pipelines, and it can be deployed privately as a container. Its command line output lets users refine a conversion further with Sigma CLI. The speaker mentioned a follow-up workshop the next day and promised more announcements soon.