Skip to main content

Sigma rule processing and conversion tools

Project description

pySigma

Tests Coverage Badge Status

pySigma is a python library that parses and converts Sigma rules into queries. It is a replacement for the legacy Sigma toolchain (sigmac) with a much cleaner design and is almost fully tested. Backends for support of conversion into query languages and processing pipelines for transforming rule for log data models are separated into dedicated projects to keep pySigma itself slim and vendor-agnostic. See the Related Projects section below to get an overview.

Getting Started

To start using pySigma, install it using your python package manager of choice. Examples:

pip install pysigma
pipenv install pysigma
poetry add pysigma

Documentation with some usage examples can be found here.

Create Your Own Backend for pySigma

The creation of a backend has become much easier with pySigma. We recommend using the "Cookie Cutter Template" and reviewing the existing backends listed in the "Related Projects" section of this README.

pySigma Cookie Cutter Template

Features

pySigma brings a number of additional features compared to the all in one sigmac, as well as some changes.

sigma-cli is the equivalent of sigmac for command-line conversion

Modifier

use sigma list modifiers

Backends

use sigma plugin list --plugin-type backend

Overview

Conversion Overview

Conversion Graph

Pipelines

Conversion Graph

More details are described in the documentation.

Testing

pySigma uses pytest as testing framework. Simply run pytest to run all tests. Run pytest --cov=sigma to get a coverage report.

Building

To build your own package run poetry build.

Linting

To lint the code run poetry run black. To check for linting errors run poetry run black --check.

This project also uses pre-commit, which is installed by poetry as part of dev dependencies. To install the git hooks run poetry run pre-commit install after cloning the repository and installing the dependencies.

Contributing

Pull requests are welcome. Please feel free to lodge any issues/PRs as discussion points.

This blog post by Micah Babinski explains the process from a developer's perspective.

Maintainers

The project is currently maintained by:

Related Projects

pySigma isn't a monolithic library attempting to support everything but the core. Support for target query languages and log data models is provided by additional packages that extend pySigma:

All packages can also be installed from PyPI if not mentioned otherwise by the Python package manager of your choice.

License

GNU Lesser General Public License v2.1. For details, please see the full license file located here.

Project details


Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

pysigma-0.11.18.tar.gz (131.8 kB view details)

Uploaded Source

Built Distribution

pysigma-0.11.18-py3-none-any.whl (145.7 kB view details)

Uploaded Python 3

File details

Details for the file pysigma-0.11.18.tar.gz.

File metadata

  • Download URL: pysigma-0.11.18.tar.gz
  • Upload date:
  • Size: 131.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/5.1.1 CPython/3.12.7

File hashes

Hashes for pysigma-0.11.18.tar.gz
Algorithm Hash digest
SHA256 eb625590dbc9822bed9ad0d64cb42fb3df69581d98c0c87f674df255b1a617d7
MD5 7c968d58a6e9a18f19d1edbfb3c19a75
BLAKE2b-256 fc345d7bf067f4219f8634609ce30190ff51da96deb3ed6d675140a1a3c03601

See more details on using hashes here.

File details

Details for the file pysigma-0.11.18-py3-none-any.whl.

File metadata

  • Download URL: pysigma-0.11.18-py3-none-any.whl
  • Upload date:
  • Size: 145.7 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/5.1.1 CPython/3.12.7

File hashes

Hashes for pysigma-0.11.18-py3-none-any.whl
Algorithm Hash digest
SHA256 0c6fe40bac12dc214b529ed87e8aae2ae350d68cf76e2e9e6176981f1976c615
MD5 eb67abac3a85dd959d4def6048692414
BLAKE2b-256 e7a66fe82d09cadf1d5756861d5a71b14e44c6e08311dddcb78d7d42b773ec97

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page