pySigma
pySigma is a python library that parses and converts Sigma rules into queries. It is a replacement
for the legacy Sigma toolchain (sigmac) with a much cleaner design and is almost fully tested.
Backends for support of conversion into query languages and processing pipelines for transforming
rule for log data models are separated into dedicated projects to keep pySigma itself slim and
vendor-agnostic. See the Related Projects section below to get an overview.
Getting Started
To start using pySigma, you need Python 3.10 or later. Install it using your python package manager of choice. Examples:
pip install pysigma
pipenv install pysigma
poetry add pysigma
Documentation with some usage examples can be found here.
Create Your Own Backend for pySigma
The creation of a backend has become much easier with pySigma. We recommend using the "Cookie Cutter Template" and reviewing the existing backends listed in the "Related Projects" section of this README.
pySigma Cookie Cutter Template
Features
pySigma brings a number of additional features compared to the all in one sigmac, as well as some changes.
sigma-cli is the equivalent of sigmac for command-line conversion
Modifier
use sigma list modifiers
Backends
use sigma plugin list --plugin-type backend
Overview
Conversion Overview
Pipelines
More details are described in the documentation.
Testing
pySigma uses pytest as testing framework. Simply run pytest to run all tests. Run pytest --cov=sigma to get a coverage report.
Building
To build your own package run poetry build.
Linting
To lint the code run poetry run black. To check for linting errors run poetry run black --check.
This project also uses pre-commit, which is installed by poetry as part of dev dependencies. To install the git hooks run poetry run pre-commit install after cloning the repository and installing the dependencies.
Contributing
Pull requests are welcome. Please feel free to lodge any issues/PRs as discussion points.
This blog post by Micah Babinski explains the process from a developer's perspective.
Maintainers
The project is currently maintained by:
- Thomas Patzke thomas@patzke.org
- François Hubaut
Related Projects
pySigma isn't a monolithic library attempting to support everything but the core. Support for target query languages and log data models is provided by additional packages that extend pySigma:
- sigma-cli: a command line interface for conversion of Sigma rules based on pySigma.
- pySigma-backend-splunk
- pySigma-pipeline-sysmon
- pySigma-pipeline-crowdstrike
- pySigma-backend-netwitness
- pySigma-backend-panther
All packages can also be installed from PyPI if not mentioned otherwise by the Python package manager of your choice.
License
GNU Lesser General Public License v2.1. For details, please see the full license file located here.
2 maintainers
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file pysigma-1.5.0.tar.gz.
File metadata
- Download URL: pysigma-1.5.0.tar.gz
- Upload date:
- Size: 140.0 kB
- Tags: Source
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
2c258cf676d2896c94279fb54c7eea664118cf08285bde122b4df75cc7b6b194
|
|
| MD5 |
f5c26138d5b81d1d806bfe5b0dc6f15a
|
|
| BLAKE2b-256 |
4d2d7bfbdb96d84ac30309e090bdb2cdb30245b69ec5a2ab349ee34d2495d74d
|
Provenance
The following attestation bundles were made for pysigma-1.5.0.tar.gz:
Publisher:
release.yml on SigmaHQ/pySigma
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pysigma-1.5.0.tar.gz -
Subject digest:
2c258cf676d2896c94279fb54c7eea664118cf08285bde122b4df75cc7b6b194 - Sigstore transparency entry: 2307115501
- Sigstore integration time:
-
Permalink:
SigmaHQ/pySigma@cb6ac5ab72957d6ca6529c5c15548672329436bb -
Branch / Tag:
refs/tags/v1.5.0 - Owner: https://github.com/SigmaHQ
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@cb6ac5ab72957d6ca6529c5c15548672329436bb -
Trigger Event:
release
-
Statement type:
File details
Details for the file pysigma-1.5.0-py3-none-any.whl.
File metadata
- Download URL: pysigma-1.5.0-py3-none-any.whl
- Upload date:
- Size: 169.2 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? Yes
- Uploaded via:
twine/7.0.0 CPython/3.13.14
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
871452a262aedb17d9e85344142944c5a0ac50e8b57408ec355efeb1329231b6
|
|
| MD5 |
07c240edc4c8d3b049a713b17f134155
|
|
| BLAKE2b-256 |
09bba1e169539d8d4218fea68a1a3bd7b9cb7898cb606851cdb75c29f2079fb5
|
Provenance
The following attestation bundles were made for pysigma-1.5.0-py3-none-any.whl:
Publisher:
release.yml on SigmaHQ/pySigma
-
Statement:
-
Statement type:
https://in-toto.io/Statement/v1 -
Predicate type:
https://docs.pypi.org/attestations/publish/v1 -
Subject name:
pysigma-1.5.0-py3-none-any.whl -
Subject digest:
871452a262aedb17d9e85344142944c5a0ac50e8b57408ec355efeb1329231b6 - Sigstore transparency entry: 2307115521
- Sigstore integration time:
-
Permalink:
SigmaHQ/pySigma@cb6ac5ab72957d6ca6529c5c15548672329436bb -
Branch / Tag:
refs/tags/v1.5.0 - Owner: https://github.com/SigmaHQ
-
Access:
public
-
Token Issuer:
https://token.actions.githubusercontent.com -
Runner Environment:
github-hosted -
Publication workflow:
release.yml@cb6ac5ab72957d6ca6529c5c15548672329436bb -
Trigger Event:
release
-
Statement type:
