pySigma

What it is and what it does

pySigma is a Python library that parses Sigma detection rules—a vendor-neutral format for security detection logic—and converts them into queries for specific security backends and log analysis platforms. It replaces the older sigmac tool with a cleaner, modular architecture where the core library remains slim and vendor-agnostic, while support for specific query languages and log data models is provided by separate backend and pipeline packages.

The library is designed for security engineers and threat hunters who need to translate detection rules across different SIEM and log analysis platforms without rewriting them for each system. It includes support for rule modifiers and processing pipelines. The project is actively maintained, supports Python 3.10 through 3.14, and has no known security vulnerabilities.

Use it for:

• Translate threat detection rules across multiple SIEM platforms from a single Sigma rule source.
• Apply data model transformations to Sigma rules before backend conversion.
• Build custom backends for proprietary or internal log analysis systems using the extension framework.
• Validate and test Sigma rule syntax and logic before deploying to production systems.
• Migrate detection logic from legacy sigmac toolchain to the modular pySigma architecture.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses and converts Sigma detection rules into queries for various security backends and log analysis platforms, replacing the legacy sigmac toolchain with a modular, vendor-agnostic design.

Yes. pySigma is actively maintained, has low install friction, no security vulnerabilities, and fills a clear need for teams managing detection rules across multiple platforms. The copyleft license (LGPL-2.1-only) is standard for security tooling and poses no barrier for most use cases. Install it if you work with Sigma rules or need to convert detection logic across SIEM platforms.

Install

pysigma on PyPI

pip install pysigma

uv add pysigma

poetry add pysigma

Installing pySigma

Before you install

Low friction: pure Python wheel with no compiled dependencies. Active maintenance with a release 14 days ago; requires Python 3.10 or later. Ten runtime dependencies are all standard libraries.

License in practice

Licensed under LGPL-2.1-only (copyleft). Derivative works and modifications must be distributed under the same license; static linking or distribution of modified versions requires source disclosure.

Quickstart

pip install pysigma

import pyyaml
import jinja2
import requests

# pySigma parses Sigma rules and converts them via backend plugins
# Backend-specific conversion requires installing a dedicated backend package

Requires Python 3.10 or later; backend-specific conversion requires installing a dedicated backend package separate from pySigma itself.

Verify before relying

• Whether the package handles all Sigma rule syntax versions or has known limitations in rule parsing coverage.
• Performance characteristics when processing large rule sets or complex detection logic.
• Stability of the plugin/backend extension API across minor versions.
• Concrete examples of rule conversion workflows beyond what the description excerpt provides.

Package facts

Evidence: pysigma-1.5.0-py3-none-any.whl

Tags

More Security packages