Simple definition
Sigma is an open, generic format for describing log-based detection rules independently of a specific SIEM platform.
Technical definition
A Sigma rule is commonly written in YAML and defines log sources, field selections, matching conditions, and metadata such as severity, tags, and references. The rule can then be converted into different query languages.
How it works / role
Sigma separates detection logic from the engine that executes it. A rule is mapped to the target log schema and then translated or imported into a SIEM. Detection quality therefore also depends on correct field mapping and on the availability of the expected events.
What is it used for?
Share, version, and port security detections across multiple platforms without rewriting the complete detection logic for every SIEM.
Practical example
A Sigma rule detects suspicious PowerShell activity. It is converted to the organization’s SIEM query language and then tested against the collected Windows logs.
Common issues
- Field mapping differs between the rule and the SIEM
- The required log source is missing or poorly normalized
- A generic rule produces too many false positives
- The conversion requires platform-specific adjustments
Key takeaway: Sigma standardizes detection logic, but every deployment must validate log sources, field mapping, and the resulting query on the target SIEM.