What is Sigma?
Sigma is an open, vendor-neutral format for detection rules. Write the logic in YAML once and convert it to Splunk, Microsoft Sentinel/Defender KQL, Elastic and more with sigma-cli (pySigma).
1 Detection as code
Rules live in Git with reviews, tests and versioning, like software.
2 logsource + detection
logsource says which logs; detection holds selections and a condition.
3 Backends & pipelines
Backends produce the query language; pipelines map field names to your data (e.g. Sysmon).
The scenario: Detect encoded PowerShell in every SIEM
Your company runs Splunk on-prem and Microsoft Defender XDR in the cloud. Turn the team's Sigma rule for encoded PowerShell into working queries for both, after validating it.
Run this lab live in the platform
A simulated terminal with 4 objectives, hints and scenario questions. Included with NERvE Pro.
Open the Sigma labStep-by-step: Sigma commands used in this lab
1Read the Sigma rule
It's in rules/.
cat rules/proc_creation_win_powershell_encoded.yml2Validate the rules
sigma check validates syntax and conventions.
sigma check rules/3Convert it for Splunk (Sysmon data)
Target splunk, pipeline sysmon.
sigma convert -t splunk -p sysmon rules/proc_creation_win_powershell_encoded.yml4Convert it for Microsoft Defender XDR (KQL)
Target kusto, pipeline microsoft_xdr.
sigma convert -t kusto -p microsoft_xdr rules/proc_creation_win_powershell_encoded.ymlKey takeaways
- Write detection logic once in Sigma; convert per SIEM.
- Map rules to ATT&CK tags for coverage reporting.
- Document and filter known false positives.
- Validate rules in CI with sigma check before deploying.
Install Sigma and practise for real
pipx install sigma-cli && sigma plugin install splunk kusto sysmon microsoft365defenderThousands of community rules are on github.com/SigmaHQ/sigma to learn from. Only scan or test systems you own or are explicitly authorised to assess. Official site: sigmahq.io · Licence: DRL 1.1 / LGPL.
Scenario questions
What's the main benefit of Sigma?
Answer: One rule can be converted to many SIEM query languages. Sigma separates detection logic from the SIEM, so teams share and reuse rules.
Why does the rule have filter_sccm?
Answer: To exclude a known legitimate source and reduce false positives. Tuning out known-good activity keeps alerts trustworthy.
What does the processing pipeline (-p sysmon / microsoft_xdr) do?
Answer: Maps generic Sigma field names to the fields in your data. Pipelines translate fields like Image to FolderPath for each data source.
More open-source tool labs
Wazuh
An open-source SIEM and XDR: collect logs, detect attacks, respond automatically.
Nmap
Discover hosts, open ports and services on networks you're authorised to assess.
Wireshark / tshark
See exactly what's crossing the wire and spot malware calling home.
Zeek
Turn raw traffic into rich, searchable logs for threat hunting.
Suricata
Detect attacks in network traffic with signatures, and write your own.
YARA
Describe malware by its patterns and hunt for it across files.