One detection idea, written once in YAML, running in ANY SIEM — Splunk, Elastic, Wazuh, Sentinel. Sigma is the universal language of detection engineering.
Follow the steps — click any step card to replay the terminal demo from that point. Everything runs in a lab you control.
Rules are readable: where Image endswith mimikatz or command patterns.
Learn 10 modifiers (endswith, contains, re…) and you can read most rules.
PySigma/sigmac compiles YAML → native query languages.
Detection engineering loop in miniature.
Your first authored detection — portfolio-ready immediately.
| logsource | where the log lives |
| detection | fields+conditions |
| contains/endswith | value modifiers |
| condition | combination logic |
| sigmac/uncoder | convert targets |
| falsepositives | declared tuning hints |
uncoder.io converts in-browser when you don't want the CLI.
SOC Prime's public rules + SigmaHQ repo = thousands of examples.
Contribution-friendly repo: get accepted, get real-world credit.
Attack with Atomic Red Team → verify your Sigma fires. That's the craft.
Use Sigma only on systems you own or have written permission to test. Your lab: Kali + Metasploitable2, DVWA, TryHackMe & HackTheBox — plenty of legal targets, zero risk.