{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"},{"label":"Log Analysis","url":"https://skillfed.io/packages/category/internet-log-analysis"}],"enrichment":{"capability":"Sigmatools provides command-line utilities and a Python library for working with Sigma detection rules\u2014a vendor-agnostic format for describing log-based security detections.","skillfed_tags":["siem-detection","rule-conversion","threat-hunting"],"use_cases":["Convert Sigma detection rules to platform-specific query syntax for deployment in your SIEM","Validate and parse Sigma YAML rules as part of a detection engineering workflow","Leverage the community's 3000+ peer-reviewed Sigma rules for threat detection","Integrate Sigma rule conversion into a security tool to support vendor-agnostic rule ingestion","Apply threat-hunting rules to log data across multiple log sources"],"what_it_does":"Sigmatools is a Python package and command-line tool for working with Sigma, a generic, open signature format designed to describe log-based security detections in a standardized, vendor-agnostic way. It provides utilities to parse, validate, and convert Sigma detection rules into queries compatible with various SIEM platforms and log analysis tools. The package is built on top of a community-maintained repository of more than 3000 peer-reviewed detection rules covering generic threats, threat hunting, emerging threats, and compliance violations.\n\nThe primary use case is enabling security teams to share and reuse detection logic across different tooling ecosystems without rewriting rules for each platform. Sigmatools handles the conversion layer, allowing a single rule to be deployed to multiple SIEMs or integrated into custom detection pipelines. It has been in active development since 2017-12-08 and is classified as Production/Stable, with support for Python 3.8 and later and no external runtime dependencies.","worth_installing":"Yes, if you work with log-based detection rules or operate multiple SIEM platforms. Sigmatools is actively maintained, production-stable, and solves a real problem\u2014standardizing detection logic across vendor silos. The LGPLv3 license is permissive for internal use and integration. High install friction is offset by zero runtime dependencies and a mature codebase. Not worth installing if you only use a single SIEM or have no need for rule conversion."},"id":"sigmatools","links":{"html":"https://skillfed.io/packages/sigmatools","md":"https://skillfed.io/packages/sigmatools.md","pypi":"https://pypi.org/project/sigmatools/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2023-04-15","license_spdx":null,"license_treatment":"copyleft","name":"sigmatools","python_support":"supports_current","summary":"Tools for the Generic Signature Format for SIEM Systems"},"popularity":{"monthly_downloads":77367,"position":14532,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.23.1"}