pySigma Documentation

pySigma is a Python library for parsing, processing, and converting Sigma rules into queries for various security monitoring systems. It is the successor to the legacy sigmac tool, featuring a clean architecture with comprehensive testing.

Contents

• Introduction
  • What is pySigma?
  • Purpose
  • Ecosystem
• Getting Started
  • Requirements
  • Installation
  • Quick Example
  • Using Processing Pipelines
  • Loading Rules from Files
  • Validating Rules
  • Next Steps
• User Guides
  • Converting Sigma Rules into Queries
  • Building a Backend
  • Writing Processing Pipelines
  • Validating Sigma Rules
  • Plugin System
• API Reference
  • Rules
  • Collection
  • Backends
  • Processing Pipeline
  • Processing Conditions
  • Transformations
  • Post-Processing and Finalization
  • Validators
  • Types
  • Modifiers
  • Correlations
  • Exceptions
• Documentation TODO
  • Outstanding Items

Indices and Tables

• Index

• Module Index

• Search Page