---
id: pysigma
version: "1.5.0"
license: LGPL-2.1-only
license_treatment: copyleft
maintenance: active
---

# pySigma — Sigma rule processing and conversion tools

License: copyleft · Maintenance: active · Downloads: 466.0K/mo

## What it is and what it does

pySigma is a Python library that parses Sigma detection rules—a vendor-neutral format for security detection logic—and converts them into queries for specific security backends and log analysis platforms. It replaces the older sigmac tool with a cleaner, modular architecture where the core library remains slim and vendor-agnostic, while support for specific query languages and log data models is provided by separate backend and pipeline packages.

The library is designed for security engineers and threat hunters who need to translate detection rules across different SIEM and log analysis platforms without rewriting them for each system. It includes support for rule modifiers and processing pipelines. The project is actively maintained, supports Python 3.10 through 3.14, and has no known security vulnerabilities.

Use it for:

- Translate threat detection rules across multiple SIEM platforms from a single Sigma rule source.
- Apply data model transformations to Sigma rules before backend conversion.
- Build custom backends for proprietary or internal log analysis systems using the extension framework.
- Validate and test Sigma rule syntax and logic before deploying to production systems.
- Migrate detection logic from legacy sigmac toolchain to the modular pySigma architecture.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses and converts Sigma detection rules into queries for various security backends and log analysis platforms, replacing the legacy sigmac toolchain with a modular, vendor-agnostic design.

Yes. pySigma is actively maintained, has low install friction, no security vulnerabilities, and fills a clear need for teams managing detection rules across multiple platforms. The copyleft license (LGPL-2.1-only) is standard for security tooling and poses no barrier for most use cases. Install it if you work with Sigma rules or need to convert detection logic across SIEM platforms.

## Install

pip install pysigma
uv add pysigma
poetry add pysigma

## Installing pySigma

Before you install: Low friction: pure Python wheel with no compiled dependencies. Active maintenance with a release 14 days ago; requires Python 3.10 or later. Ten runtime dependencies are all standard libraries.

License in practice: Licensed under LGPL-2.1-only (copyleft). Derivative works and modifications must be distributed under the same license; static linking or distribution of modified versions requires source disclosure.

Quickstart:

pip install pysigma

import pyyaml
import jinja2
import requests

# pySigma parses Sigma rules and converts them via backend plugins
# Backend-specific conversion requires installing a dedicated backend package

Requires Python 3.10 or later; backend-specific conversion requires installing a dedicated backend package separate from pySigma itself.

Verify before relying:

- Whether the package handles all Sigma rule syntax versions or has known limitations in rule parsing coverage.
- Performance characteristics when processing large rule sets or complex detection logic.
- Stability of the plugin/backend extension API across minor versions.
- Concrete examples of rule conversion workflows beyond what the description excerpt provides.

## Package facts

- License: LGPL-2.1-only (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 466.0K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

sigma rule parsing and conversion, sigma to query language translation, security rule processing, detection rule backend conversion, sigma rule compiler, threat detection rule translation, SIEM rule conversion, sigma-rules, siem-conversion, threat-detection

[View on SkillFed](https://skillfed.io/packages/pysigma) · [View on PyPI](https://pypi.org/project/pysigma/)