sigma-cli

No entries match these filters. Clear filters

1. v4.0.0 Oct 28, 2026 · issue 124

   sigma-cli adds --policy safe and --policy trusted security profiles with RE2RE2A regular-expression engine developed by Google that guarantees linear-time matching, preventing the catastrophic backtracking that plagues PCRE-style engines and making it safe to run untrusted patterns. regex engine, template-variable control, and external-source blocking⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSIONpipxgit

   pipx copy

   $ pipx install sigma-cli==4.0.0
   # already installed? upgrade to this version:
   $ pipx install --force sigma-cli==4.0.0

   git copy

   $ git clone --branch v4.0.0 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v4.0.0

   PyPI attestation · checked 29 Oct

   └──▷ TRY IT
   Convert untrusted community rules with the safe default policy to guard against regex DoS — no extra flags needed; RE2 and blocked external sources are on by default.
   copy

   $ sigma convert -t splunk -p sysmon --policy safe sigma/rules/windows/process_creation

   Convert rules from a trusted internal library that use template variables and Python-native regex patterns — upgrade from v3 behaviour by passing --policy trusted --enable-template-vars.
   copy

   $ sigma convert -t splunk -p sysmon --policy trusted --enable-template-vars sigma/rules/windows/

   Validate a rule set with check while keeping the safe policy but explicitly allowing external sources for a controlled pipeline environment.
   copy

   $ sigma check --policy safe --allow-external-sources sigma/rules/windows/process_creation/

   • Control rule-processing security with --policy safe (default) or --policy trusted on both the convert and check commands — safe mode uses the RE2 regex engine, disables template variable expansion, and blocks external rule sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Override the regex engine independently with --regex-engine re2 or --regex-engine python regardless of the active policy.
   • Enable template variable expansion when needed with --enable-template-vars (emits a security warning) on convert and check.
   • Allow external rule sources explicitly with --allow-external-sources on convert and check.
   • sigma-cli now migrates to pySigma 2 as its underlying library.
   • Control rule-processing security with --policy safe (default) or --policy trusted on both the convert and check commands — safe mode uses the RE2 regex engine, disables template variable expansion, and blocks external rule sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Override the regex engine independently with --regex-engine re2 or --regex-engine python regardless of the active policy.
   • Enable template variable expansion when needed with --enable-template-vars (emits a security warning) on convert and check.
   • Allow external rule sources explicitly with --allow-external-sources on convert and check.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The default policy is now safe, which switches the regex engine to RE2, disables template variable expansion, and blocks external rule sources — existing scripts that rely on Python-native regex, template variables, or external sources will break unless --policy trusted (or the relevant individual flags) is added.
2. v3.1.0 Jul 7, 2026 · issue 009

   sigma-cli v3.1.0 adds JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers. export and per-rule file output with directory structure preservation.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.1.0 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v3.1.0

   └──▷ TRY IT
   Output each converted rule as its own file mirroring the source directory layout — useful for version-controlled rule repos or selective SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. deployment.
   copy

   $ sigma convert -t esql -p ecs_windows --output-dir translated/ --output-filename-template "{path}/{stem}.esql" rules/

   Flatten all converted rules into a single directory with per-rule files, handling rules that emit multiple queries by appending an index suffix.
   copy

   $ sigma convert -t esql -p ecs_windows --output-dir translated/ --output-filename-template "{stem}-{index}.esql" rules/

   • Adds JUnit XML export for sigma convert results, enabling CI pipeline integration with standard test reporting tools.
   • Adds --output-dir and --output-filename-template flags to write each converted rule to a separate file, with optional preservation of the source directory hierarchy.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported
3. v3.0.3 Jul 2, 2026 · issue 002

   sigma-cli v3.0.3 adds Homebrew installation support for macOS users.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.3 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v3.0.3

   └──▷ TRY IT
   Install sigma-cli on macOS without Python tooling — useful for quick setup on analyst workstations.
   copy

   $ brew install sigma-cli

   • Supports Homebrew installation on macOS, enabling brew install sigma-cli as a new install path.

   1 detail in Everything

4. v3.0.1 Apr 14, 2026 · release notes

   sigma-cli v3.0.1 adds --url parameter to pysigma update-cache for custom cache sources.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.1 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v3.0.1

   └──▷ TRY IT
   Pull the pySigma plugin cache from a self-hosted or alternative URL instead of the default upstream source.
   copy

   $ sigma pysigma update-cache --url https://your-internal-mirror.example.com/sigma-cache.json

5. v3.0.0 Apr 13, 2026 · release notes

   sigma-cli v3.0.0 adds explicit opt-in flag for template vars and a custom path allowlist for pipeline security.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.0.0 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v3.0.0

   └──▷ TRY IT
   Re-enable template vars for an existing pipeline that relies on them, pointing to a trusted vars file outside the default allowed path.
   copy

   $ sigma convert -t splunk -p my_pipeline.yml --enable-template-vars --template-vars-path /opt/sigma/vars my_rules/

   • New --enable-template-vars flag explicitly opts in to custom template variable Python files (previously on by default).
   • New --template-vars-path flag defines a custom allowlist of paths from which template vars Python files may be loaded.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Custom template vars are now disabled by default; existing pipelines using template vars will break unless --enable-template-vars is passed.
   • !Without --template-vars-path, template vars Python files must now reside in the same directory or a sub-directory of the pipeline YAML configuration; files in other locations will no longer load.
6. v2.0.2 Apr 3, 2026 · release notes

   sigma-cli v2.0.2 adds field grouping in analysis and a Plugin column in list commands.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.2 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v2.0.2

   └──▷ TRY IT
   Group field analysis results by log source or category to quickly spot which fields are most common in a given context.
   copy

   $ sigma analyze fields --group <field> <path>

   • Adds --group argument to sigma analyze fields to group field frequency results by a specified dimension.
   • Adds a Plugin column to sigma list targets and sigma list pipelines output, showing which plugin provides each target or pipeline.

   2 details in Everything

7. v2.0.0 Nov 30, 2025 · release notes

   sigma-cli v2.0.0 adds rule field analysis and MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. cache management commands.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0

   └──▷ TRY IT
   Identify all field names referenced across your Sigma rules to audit coverage or plan backend mappings.
   copy

   $ sigma analyze <path>

   • New analyze command extracts field names from Sigma rules.
   • New cache management commands for MITRE content.
   • Updated to pySigma 1.0.

   3 details in Everything

8. v1.0.6 Apr 16, 2025 · release notes

   sigma-cli v1.0.6 adds level/status filtering to MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. analysis and titles ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator layers.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.0.6 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.0.6

   └──▷ TRY IT
   Scope a MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage analysis to only high-severity, stable rules to reduce noise in the Navigator layer.
   copy

   $ sigma mitre analyze --level high --status stable rules/

   • Adds level and status filter options to mitre analyze for scoping ATT&CK coverage reports by rule severity or status.
   • ATT&CK Navigator layers exported via mitre analyze now include a title field for easier identification.

   2 details in Everything

9. v1.0.5 Jan 20, 2025 · release notes

   sigma-cli v1.0.5 adds verbose conversion output, directory-based pipelines, and a new log source analysis command.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.0.5 https://github.com/SigmaHQ/sigma-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.0.5

   └──▷ TRY IT
   Troubleshoot conversion issues by seeing exactly how each rule is processed through a pipeline.
   copy

   $ sigma convert --verbose -t splunk -p my_pipeline.yml rules/

   Apply an entire folder of ordered pipeline YAMLs at once instead of chaining multiple --pipeline flags.
   copy

   $ sigma convert -t elastic-lucene --pipeline ./pipelines/ rules/windows/

   Audit which log sources are covered across your Sigma rule set before deploying to a new environment.
   copy

   $ sigma analyze logsources rules/

   • Adds --verbose option to sigma convert for detailed conversion output.
   • Allows --pipeline in sigma convert to accept a directory of pipeline files, applying all pipelines within it.
   • New sigma analyze subcommand to analyze log sources across Sigma rules.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.8 is no longer supported; Python 3.9 is now the minimum required version.
10. v1.0.4 Jun 27, 2024 · release notes

    sigma-cli v1.0.4 adds -h short help flag and updates pySigma

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.4 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.0.4

    └──▷ USE IT
    Quickly view command help without typing --help
    shell copy

    sigma-cli -h

    • Adds -h short option for the help command in sigma-cli
    • Updates pySigma dependency to current version

    2 details in Everything

11. v1.0.0 Jan 29, 2024 · release notes

    sigma-cli v1.0.0 adds correlation rule support, --force-install CLI flag, and plugin capability exposure

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ TRY IT
    Force install a plugin that the CLI considers incompatible with the current version.
    copy

    $ sigma-plugin install --force-install some-incompatible-plugin

    View which capabilities a specific plugin exposes after installation.
    copy

    $ sigma-plugin details some-plugin-name

    • Adds pySigma 0.11 backend integration enabling correlation rules processing within the CLI workflow.
    • Adds the --force-install (shortcut -f) CLI flag to bypass compatibility checks when installing plugins.
    • Enhances sigma-plugin list and sigma-plugin details commands to expose the full set of plugin capabilities.
    • Adds a post-installation check that detects incompatible pySigma versions after plugin installation and prompts for reinstallation.

    4 details in Everything

12. v0.7.10 Nov 14, 2023 · release notes

    Adds --exclude argument to sigma check for filtering rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.10 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.7.10

13. v0.7.7 Aug 31, 2023 · release notes

    Adds query post-processing and output finalization stages to sigma-cli pipelines

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.7 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.7.7

14. v0.7.6 May 17, 2023 · release notes

    sigma-cli v0.7.6 adds version command and expands ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. heatmap configuration options.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.6 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.7.6

    └──▷ USE IT
    Check the currently installed sigma-cli version in a CI/CD pipeline or troubleshooting session.
    shell copy

    sigma-cli version

    • Adds version subcommand to display the installed sigma-cli version.
    • Extends configuration possibilities for ATT&CK heatmap generation.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sigma-cli now exits if legacy Sigmatools are installed to prevent errors caused by incompatibilities.
15. v0.7.3 Apr 30, 2023 · release notes

    Adds sigma list subcommand to inspect modifiers/transforms and enforces input files for check.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.3 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.7.3

    • Adds sigma list subcommand (with modifiers, processing_transformations, and conditions variants) to list supported capabilities.
    • Changes sigma check to require explicit input files; passing nothing no longer silently succeeds.
    • Enables reading rule definitions from standard input when - is passed as the file argument.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sigma check now fails if no input file arguments are provided (previously it exited silently).
16. v0.7.0 Feb 20, 2023 · release notes

    sigma-cli v0.7.0 introduces --backend-option for custom backend config and removes legacy time flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.7.0 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.7.0

    • Adds --backend-option / -O flag to pass key=value pairs directly to the backend
    • Removes support for --min-time and --max-time flags

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --min-time flag is removed; use --backend-option min_time=... instead.
    • !The --max-time flag is removed; use --backend-option max_time=... instead.
17. v0.6.0 Feb 14, 2023 · release notes

    sigma-cli v0.6.0 introduces a plugin system managed via the new sigma plugin command group.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.6.0 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.6.0

    └──▷ TRY IT
    List available plugins in the new system
    copy

    $ sigma plugin list

    └──▷ BREAKING ON UPGRADE

    • !Backends and pipelines are no longer installed via legacy mechanisms; you must use the new sigma plugin command group to manage them, requiring migration from v0.5.x for unmigrated components.
18. v0.5.1 Oct 5, 2022 · release notes

    sigma-cli v0.5.1 adds rule validation capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.1 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.5.1

    • Adds rule validation to the CLI

    1 detail in Everything

19. v0.5.0 Aug 5, 2022 · release notes

    sigma-cli v0.5.0 adds validation checks for pipeline requirements and introduces new config keys skip.authors and include.labels to control which pull requests get scanne

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.5.0 https://github.com/SigmaHQ/sigma-cli.git
    # already have the repo? check out this version:
    $ git checkout v0.5.0

    • Adds validation step in processing pipeline check that verifies if the target requires a specific pipeline.
    • Adds validation step in pipeline usage check that confirms whether used pipelines are intended for use with the target.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The sigma.cli.pipelines config key now expects a dict of pipeline definitions instead of its previous format.