← retour aux outils back to tools

# sigma-cli

Outil en ligne de commande pour la gestion des règles de détection Sigma. Convertit les règles Sigma vers des langages de requête SIEM : Splunk, Elasticsearch, QRadar, ArcSight, et plus encore. Command-line tool for Sigma detection rule management. Converts Sigma rules to SIEM query languages — Splunk, Elasticsearch, QRadar, ArcSight, and more.

↗ https://github.com/SigmaHQ/sigma-cli

## Overview

sigma-cli is the official command-line tool for working with Sigma detection rules. Sigma is an open, vendor-neutral SIEM rule format — sigma-cli converts rules to specific SIEM query languages (Splunk SPL, Elasticsearch DSL, QRadar AQL, etc.) and manages rule collections.

## Installation

    pip3 install sigma-cli

    # Install backend plugins for specific SIEMs
    pip3 install pySigma-backend-splunk
    pip3 install pySigma-backend-elasticsearch
    pip3 install pySigma-backend-qradar

## Basic Usage

Convert a Sigma rule to Splunk query

    sigma convert -t splunk -p splunk-windows rule.yml

Convert to Elasticsearch

    sigma convert -t elasticsearch -p ecs-windows rule.yml

Convert directory of rules

    sigma convert -t splunk -p splunk-windows /path/to/rules/

List available backends (SIEMs)

    sigma list backends

List available processing pipelines

    sigma list pipelines

## Sigma Rule Format

    # Example Sigma rule structure
    title: Suspicious PowerShell Encoded Command
    id: 5b572db9-0234-4b4a-a254-8be3d2bd3264
    status: experimental
    description: Detects PowerShell with encoded command execution
    author: Security Team
    date: 2024/01/15
    tags:
        - attack.execution
        - attack.t1059.001
    logsource:
        category: process_creation
        product: windows
    detection:
        selection:
            CommandLine|contains:
                - '-EncodedCommand'
                - '-enc '
                - '-ec '
        condition: selection
    falsepositives:
        - Legitimate administration scripts
    level: medium

## Backend-Specific Conversion

Splunk (Windows)

    sigma convert -t splunk -p splunk-windows rule.yml

Splunk (Linux)

    sigma convert -t splunk -p splunk-linux rule.yml

Elasticsearch ECS

    sigma convert -t elasticsearch -p ecs-windows rule.yml

Lucene query (for Kibana)

    sigma convert -t lucene -p ecs-windows rule.yml

QRadar

    sigma convert -t qradar -p qradar-windows rule.yml

Microsoft Sentinel (KQL)

    sigma convert -t microsoft365defender rule.yml

## Rule Management

Check rule syntax

    sigma check rule.yml

Check directory of rules

    sigma check /path/to/rules/

Format/lint rules

    sigma format rule.yml

List rule metadata

    sigma list rules /path/to/rules/

## Downloading Official Rule Sets

Clone the official Sigma rules repository

    git clone https://github.com/SigmaHQ/sigma /opt/sigma

Convert all Windows rules to Splunk

    sigma convert -t splunk -p splunk-windows \
      /opt/sigma/rules/windows/ \
      -o splunk_windows_rules.spl

    # Convert only high/critical severity rules
    find /opt/sigma/rules/ -name "*.yml" -exec grep -l "level: critical\|level: high" {} \; > high_rules.txt
    sigma convert -t splunk -p splunk-windows $(cat high_rules.txt) -o high_priority.spl

## Tips

- sigma-cli is the bridge between rule writing and SIEM deployment
- Always validate rules with `sigma check` before deployment
- The official Sigma rule repo has 2000+ detection rules covering MITRE ATT&CK
- For Splunk users: install the `pySigma-backend-splunk` plugin for best results

Help / Man page

    sigma [command] [options]

    Commands:
      convert     Convert rules to SIEM query language
      check       Validate Sigma rules
      format      Format and normalize rules
      list        List backends, pipelines, or rules

    convert options:
      -t BACKEND  Target backend (SIEM)
      -p PIPELINE Processing pipeline
      -o FILE     Output file
      -f FORMAT   Output format

    list options:
      backends    Show available backends
      pipelines   Show available pipelines
      rules DIR   List rules in directory

## Vue d’ensemble

sigma-cli est l’outil en ligne de commande officiel pour travailler avec les règles de détection Sigma. Sigma est un format de règle SIEM ouvert et agnostique du vendeur : sigma-cli convertit les règles vers des langages de requête SIEM spécifiques (Splunk SPL, Elasticsearch DSL, QRadar AQL, etc.) et gère les collections de règles.

## Installation

    pip3 install sigma-cli

    # Installer des plugins backend pour des SIEM spécifiques
    pip3 install pySigma-backend-splunk
    pip3 install pySigma-backend-elasticsearch
    pip3 install pySigma-backend-qradar

## Utilisation de base

    # Convertir une règle Sigma en requête Splunk
    sigma convert -t splunk -p splunk-windows rule.yml

    # Convertir vers Elasticsearch
    sigma convert -t elasticsearch -p ecs-windows rule.yml

    # Convertir un répertoire de règles
    sigma convert -t splunk -p splunk-windows /path/to/rules/

    # Lister les backends disponibles (SIEM)
    sigma list backends

    # Lister les pipelines de traitement disponibles
    sigma list pipelines

## Format de règle Sigma

    # Exemple de structure de règle Sigma
    title: Suspicious PowerShell Encoded Command
    id: 5b572db9-0234-4b4a-a254-8be3d2bd3264
    status: experimental
    description: Detects PowerShell with encoded command execution
    author: Security Team
    date: 2024/01/15
    tags:
        - attack.execution
        - attack.t1059.001
    logsource:
        category: process_creation
        product: windows
    detection:
        selection:
            CommandLine|contains:
                - '-EncodedCommand'
                - '-enc '
                - '-ec '
        condition: selection
    falsepositives:
        - Legitimate administration scripts
    level: medium

## Conversion spécifique par backend

    # Splunk (Windows)
    sigma convert -t splunk -p splunk-windows rule.yml

    # Splunk (Linux)
    sigma convert -t splunk -p splunk-linux rule.yml

    # Elasticsearch ECS
    sigma convert -t elasticsearch -p ecs-windows rule.yml

    # Requête Lucene (pour Kibana)
    sigma convert -t lucene -p ecs-windows rule.yml

    # QRadar
    sigma convert -t qradar -p qradar-windows rule.yml

    # Microsoft Sentinel (KQL)
    sigma convert -t microsoft365defender rule.yml

## Gestion des règles

    # Vérifier la syntaxe d'une règle
    sigma check rule.yml

    # Vérifier un répertoire de règles
    sigma check /path/to/rules/

    # Formater/linter les règles
    sigma format rule.yml

    # Lister les métadonnées des règles
    sigma list rules /path/to/rules/

## Télécharger les jeux de règles officiels

    # Cloner le dépôt officiel des règles Sigma
    git clone https://github.com/SigmaHQ/sigma /opt/sigma

    # Convertir toutes les règles Windows en Splunk
    sigma convert -t splunk -p splunk-windows \
      /opt/sigma/rules/windows/ \
      -o splunk_windows_rules.spl

    # Convertir uniquement les règles de sévérité haute/critique
    find /opt/sigma/rules/ -name "*.yml" -exec grep -l "level: critical\|level: high" {} \; > high_rules.txt
    sigma convert -t splunk -p splunk-windows $(cat high_rules.txt) -o high_priority.spl

## Conseils

- sigma-cli fait le pont entre l’écriture des règles et leur déploiement en SIEM
- Toujours valider les règles avec `sigma check` avant déploiement
- Le dépôt officiel de règles Sigma compte plus de 2000 règles de détection couvrant MITRE ATT&CK
- Pour les utilisateurs Splunk : installer le plugin `pySigma-backend-splunk` pour de meilleurs résultats

Aide / Page de manuel

    sigma [command] [options]

    Commands:
      convert     Convert rules to SIEM query language
      check       Validate Sigma rules
      format      Format and normalize rules
      list        List backends, pipelines, or rules

    convert options:
      -t BACKEND  Target backend (SIEM)
      -p PIPELINE Processing pipeline
      -o FILE     Output file
      -f FORMAT   Output format

    list options:
      backends    Show available backends
      pipelines   Show available pipelines
      rules DIR   List rules in directory