← all datasets
from the project README
◆ Detection rules
Sigma Rules
DRL-1.1The main open repository of generic SIEM detection rules in Sigma format, mapped to ATT&CK.
Summary
Welcome to the Sigma main rule repository. The place where detection engineers, threat hunters and all defensive security practitioners collaborate on detection rules. The repository offers more than 3000 detection rules of different type and aims to make reliable detections accessible to all at no cost.
- Formats
sigma- License
- DRL-1.1
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ git clone --depth 1 https://github.com/SigmaHQ/sigma
Shallow clone: history isn’t needed for testing.
Contents
5,533 files 48.1 MB repository
-
.yml4,520 -
.json462 -
.evtx459 -
.md51 -
.png18 -
.py9 -
(no ext)4 -
.csv2
Use it with
Commands are curated, not yet run by us.
sigma-cli — Convert a Sigma rule to a Splunk search (install the backend first with `sigma plugin install splunk`).
$ sigma convert -t splunk --without-pipeline sample.yml
chainsaw — Hunt through your own EVTX logs with the collection's Sigma rules, using Chainsaw's bundled mapping file.
$ chainsaw hunt logs/ -s ./sigma/rules --mapping mappings/sigma-event-logs-all.yml