https://cybertoolchain.io/tools/sigma-cli New releases and features in sigma-cli, tracked by The Cyber Toolchain. en Wed, 28 Oct 2026 11:28:40 GMT https://github.com/SigmaHQ/sigma-cli/releases/tag/v4.0.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v4.0.0 Wed, 28 Oct 2026 11:28:40 GMT sigma-cli adds `--policy safe` and `--policy trusted` security profiles with RE2 regex engine, template-variable control, and external-source blocking⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Control rule-processing security with `--policy safe` (default) or `--policy trusted` on both the `convert` and `check` commands — safe mode uses the RE2 regex engine, disables template variable expansion, and blocks external rule sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Override the regex engine independently with `--regex-engine re2` or `--regex-engine python` regardless of the active policy. • Enable template variable expansion when needed with `--enable-template-vars` (emits a security warning) on `convert` and `check`. • Allow external rule sources explicitly with `--allow-external-sources` on `convert` and `check`. • sigma-cli now migrates to pySigma 2 as its underlying library. Breaking changes: • The default policy is now `safe`, which switches the regex engine to RE2, disables template variable expansion, and blocks external rule sources — existing scripts that rely on Python-native regex, template variables, or external sources will break unless `--policy trusted` (or the relevant individual flags) is added. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.1.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.1.0 Tue, 07 Jul 2026 21:51:34 GMT sigma-cli v3.1.0 adds JUnit XML export and per-rule file output with directory structure preservation. • Adds JUnit XML export for sigma convert results, enabling CI pipeline integration with standard test reporting tools. • Adds `--output-dir` and `--output-filename-template` flags to write each converted rule to a separate file, with optional preservation of the source directory hierarchy. Breaking changes: • Python 3.9 is no longer supported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.0.3 https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.0.3 Thu, 02 Jul 2026 06:47:26 GMT sigma-cli v3.0.3 adds Homebrew installation support for macOS users. • Supports Homebrew installation on macOS, enabling `brew install sigma-cli` as a new install path. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.0.1 https://github.com/SigmaHQ/sigma-cli/releases/tag/v3.0.1 Tue, 14 Apr 2026 07:57:20 GMT sigma-cli v3.0.1 adds --url parameter to pysigma update-cache for custom cache sources. • Adds `--url` parameter to the `pysigma update-cache` subcommand, enabling specification of a custom URL for cache updates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v2.0.2 https://github.com/SigmaHQ/sigma-cli/releases/tag/v2.0.2 Fri, 03 Apr 2026 12:10:25 GMT sigma-cli v2.0.2 adds field grouping in analysis and a Plugin column in list commands. • Adds `--group` argument to `sigma analyze fields` to group field frequency results by a specified dimension. • Adds a `Plugin` column to `sigma list targets` and `sigma list pipelines` output, showing which plugin provides each target or pipeline. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v2.0.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v2.0.0 Sun, 30 Nov 2025 01:02:40 GMT sigma-cli v2.0.0 adds rule field analysis and MITRE cache management commands. • New `analyze` command extracts field names from Sigma rules. • New cache management commands for MITRE content. • Updated to pySigma 1.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.6 https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.6 Wed, 16 Apr 2025 00:00:06 GMT sigma-cli v1.0.6 adds level/status filtering to MITRE analysis and titles ATT&CK Navigator layers. • Adds level and status filter options to `mitre analyze` for scoping ATT&CK coverage reports by rule severity or status. • ATT&CK Navigator layers exported via `mitre analyze` now include a title field for easier identification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.5 https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.5 Mon, 20 Jan 2025 23:39:05 GMT sigma-cli v1.0.5 adds verbose conversion output, directory-based pipelines, and a new log source analysis command. • Adds `--verbose` option to `sigma convert` for detailed conversion output. • Allows `--pipeline` in `sigma convert` to accept a directory of pipeline files, applying all pipelines within it. • New `sigma analyze` subcommand to analyze log sources across Sigma rules. Breaking changes: • Python 3.8 is no longer supported; Python 3.9 is now the minimum required version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.4 https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.4 Thu, 27 Jun 2024 22:38:25 GMT sigma-cli v1.0.4 adds `-h` short help flag and updates pySigma • Adds `-h` short option for the help command in sigma-cli • Updates pySigma dependency to current version Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v1.0.0 Mon, 29 Jan 2024 23:24:33 GMT sigma-cli v1.0.0 adds correlation rule support, `--force-install` CLI flag, and plugin capability exposure • Adds `pySigma 0.11` backend integration enabling **correlation rules** processing within the CLI workflow. • Adds the `--force-install` (shortcut `-f`) CLI flag to bypass compatibility checks when installing plugins. • Enhances `sigma-plugin list` and `sigma-plugin details` commands to expose the full set of plugin capabilities. • Adds a post-installation check that detects incompatible `pySigma` versions after plugin installation and prompts for reinstallation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.10 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.10 Tue, 14 Nov 2023 21:41:19 GMT Adds `--exclude` argument to `sigma check` for filtering rules • Adds the `--exclude` argument to `sigma check` to allow disabling some rules during validation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.7 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.7 Thu, 31 Aug 2023 06:58:56 GMT Adds query post-processing and output finalization stages to sigma-cli pipelines • Adds query post-processing and output finalization stages and transformations in processing pipelines Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.6 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.6 Wed, 17 May 2023 23:41:17 GMT sigma-cli v0.7.6 adds `version` command and expands ATT&CK heatmap configuration options. • Adds `version` subcommand to display the installed sigma-cli version. • Extends configuration possibilities for ATT&CK heatmap generation. Breaking changes: • sigma-cli now exits if legacy Sigmatools are installed to prevent errors caused by incompatibilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.3 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.3 Sun, 30 Apr 2023 10:11:58 GMT Adds sigma list subcommand to inspect modifiers/transforms and enforces input files for check. • Adds `sigma list` subcommand (with `modifiers`, `processing_transformations`, and `conditions` variants) to list supported capabilities. • Changes `sigma check` to require explicit input files; passing nothing no longer silently succeeds. • Enables reading rule definitions from standard input when `-` is passed as the file argument. Breaking changes: • `sigma check` now fails if no input file arguments are provided (previously it exited silently). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.7.0 Mon, 20 Feb 2023 07:58:54 GMT sigma-cli v0.7.0 introduces `--backend-option` for custom backend config and removes legacy time flags • Adds `--backend-option` / `-O` flag to pass key=value pairs directly to the backend • Removes support for `--min-time` and `--max-time` flags Breaking changes: • The `--min-time` flag is removed; use `--backend-option min_time=...` instead. • The `--max-time` flag is removed; use `--backend-option max_time=...` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.6.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.6.0 Tue, 14 Feb 2023 07:20:47 GMT sigma-cli v0.6.0 introduces a plugin system managed via the new `sigma plugin` command group. • Introduces a plugin system where backends and pipelines are installed using the `sigma plugin` subcommand group Breaking changes: • Backends and pipelines are no longer installed via legacy mechanisms; you must use the new `sigma plugin` command group to manage them, requiring migration from v0.5.x for unmigrated components. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.5.1 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.5.1 Wed, 05 Oct 2022 21:56:16 GMT sigma-cli v0.5.1 adds rule validation capability • Adds rule validation to the CLI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.5.0 https://github.com/SigmaHQ/sigma-cli/releases/tag/v0.5.0 Fri, 05 Aug 2022 00:42:29 GMT sigma-cli v0.5.0 adds validation checks for pipeline requirements and introduces new config keys `skip.authors` and `include.labels` to control which pull requests get scanne • Adds validation step in processing pipeline check that verifies if the target requires a specific pipeline. • Adds validation step in pipeline usage check that confirms whether used pipelines are intended for use with the target. Breaking changes: • The `sigma.cli.pipelines` config key now expects a dict of pipeline definitions instead of its previous format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/sigma-cli