Individual skill
sigma-rules-guide
Not available
skills/cowork/sigma-rules-guide/SKILL.md
Source commit a991acae1b74d338ca89ec2245eaa13ad680dc8f
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 11, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
Standard SKILL.md format has not been attested at this commit. No installation command is available; inspect the source.
Repository context
- Repository stars (not skill ratings)
- 39
- Repository last updated
- Jul 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-plugins Repository topic
- ai-skills Repository topic
- claude-cowork Repository topic
- enterprise-ai Repository topic
- faos Repository topic
- gemini-cli Repository topic
- github-copilot Repository topic
- openai-codex Repository topic
- skill-marketplace Repository topic
- agentic-ai Repository topic
Declared tags are partial or unavailable.
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
<!-- AUTO-GENERATED by export-skills.py — DO NOT EDIT -->
---
name: sigma-rules-guide
description: Sigma detection rule writing guide for threat detection across SIEM platforms
tags: [detection, security]
---
# Sigma Detection Rules Guide
## Overview
Sigma is an open, vendor-agnostic signature format for describing log events and detection rules. Sigma rules can be converted into queries for virtually any SIEM platform (Splunk, Elastic, Microsoft Sentinel, Google Chronicle, Sumo Logic) using sigma converters (pySigma). This makes Sigma the de facto standard for shareable threat detection logic.
A Sigma rule describes **what** to detect in logs, not **how** a specific SIEM should query for it. This abstraction allows security teams to:
