calebstewart/python-sigma

How calebstewart/python-sigma works

This Python library loads Sigma rules into validated objects, parses detection conditions, and supports inspection, transformation, and serialization. Its CLI exposes rule conversion and transformation alongside schema, validation, listing, and MITRE-cache commands. The graph follows documented capabilities and SOURCE INDEX references; unsampled command implementations are shown as subsystem nodes, and their internal behavior is not inferred beyond those references.

Main entry points: __init__.py Command Registry · serializer Serializer Framework · sigma/schema.py Rule Schema · cli/schema.py Schema Commands

Components 17

Rule Model and Parsing

Rule Schema sigma/schema.py
Condition Grammar sigma/grammar.py

Transform and Serialize

Transformation Framework sigma/transform
Serializer Framework sigma/serializer
Elastic Serializer sigma/serializer/elastic.py

Command Line

Sigma CLI sigma/__main__.py
Command Registry sigma/cli/__init__.py
Convert Rules sigma/cli/converter.py
Transform Rules sigma/cli/transform.py
List Capabilities sigma/cli/list.py
MITRE Commands sigma/cli/mitre.py
Schema Commands sigma/cli/schema.py
Validation Command sigma/cli/validate.py

MITRE ATT&CK

ATT&CK Cache sigma/data/mitre.json
ATT&CK Data sigma/mitre.py

Other components

Engineer
ATT&CK Sources

Connections 26

Engineer → Sigma CLI: runs README.md
Sigma CLI → Command Registry: starts commands sigma/__main__.py
Command Registry → Convert Rules: registers sigma/cli/__init__.py
Command Registry → Transform Rules: registers sigma/cli/__init__.py
Command Registry → List Capabilities: registers sigma/cli/__init__.py
Command Registry → MITRE Commands: registers sigma/cli/__init__.py
Command Registry → Schema Commands: registers sigma/cli/__init__.py
Command Registry → Validation Command: registers sigma/cli/__init__.py
Convert Rules → Rule Schema: loads rules sigma/cli/converter.py
Convert Rules → Serializer Framework: serializes rules sigma/cli/converter.py
Transform Rules → Rule Schema: loads and writes sigma/cli/transform.py
Transform Rules → Transformation Framework: applies transforms sigma/cli/transform.py
Rule Schema → Condition Grammar: parses conditions sigma/schema.py
Serializer Framework → Transformation Framework: applies transforms sigma/serializer/__init__.py
Elastic Serializer → Serializer Framework: implements serializer sigma/serializer/elastic.py
Elastic Serializer → ATT&CK Data: uses ATT&CK data sigma/serializer/elastic.py
List Capabilities → Transformation Framework: lists transforms sigma/cli/list.py
List Capabilities → Serializer Framework: lists serializers sigma/cli/list.py
MITRE Commands → ATT&CK Data: manages cache sigma/cli/mitre.py
ATT&CK Data → ATT&CK Cache: reads and writes sigma/mitre.py
ATT&CK Data → ATT&CK Sources: fetches data sigma/mitre.py
Schema Commands → Rule Schema: inspects schema sigma/cli/schema.py
Schema Commands → Serializer Framework: inspects schema sigma/cli/schema.py
Schema Commands → Transformation Framework: inspects schema sigma/cli/schema.py
Validation Command → Rule Schema: validates rules sigma/cli/validate.py
Validation Command → Serializer Framework: validates serializers sigma/cli/validate.py

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·