# calebstewart/python-sigma architecture

> Architecture diagram of the GitHub repository calebstewart/python-sigma, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/calebstewart/python-sigma
- Repository: https://github.com/calebstewart/python-sigma

## Overview

This Python library loads Sigma rules into validated objects, parses detection conditions, and supports inspection, transformation, and serialization. Its CLI exposes rule conversion and transformation alongside schema, validation, listing, and MITRE-cache commands. The graph follows documented capabilities and SOURCE INDEX references; unsampled command implementations are shown as subsystem nodes, and their internal behavior is not inferred beyond those references.

Main entry points: [`sigma/cli/__init__.py`](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/__init__.py) (Command Registry), [`sigma/serializer`](https://github.com/calebstewart/python-sigma/tree/main/sigma/serializer) (Serializer Framework), [`sigma/schema.py`](https://github.com/calebstewart/python-sigma/blob/main/sigma/schema.py) (Rule Schema), [`sigma/cli/schema.py`](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/schema.py) (Schema Commands)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_rule_core["Rule Model and Parsing"]
  node_rule_schema["Rule Schema<br/>[schema.py]"]
  node_condition_grammar["Condition Grammar<br/>[grammar.py]"]
end

subgraph group_conversion["Transform and Serialize"]
  node_transforms["Transformation Framework"]
  node_serializer_framework["Serializer Framework"]
  node_elastic_serializer["Elastic Serializer<br/>[elastic.py]"]
end

subgraph group_cli["Command Line"]
  node_cli_entry["Sigma CLI<br/>[__main__.py]"]
  node_cli_root["Command Registry<br/>[__init__.py]"]
  node_convert_cmd["Convert Rules<br/>[converter.py]"]
  node_transform_cmd["Transform Rules<br/>[transform.py]"]
  node_list_cmd["List Capabilities<br/>[list.py]"]
  node_mitre_cmd["MITRE Commands<br/>[mitre.py]"]
  node_schema_cmd["Schema Commands<br/>[schema.py]"]
  node_validate_cmd["Validation Command<br/>[validate.py]"]
end

subgraph group_intel["MITRE ATT&amp;CK"]
  node_attack_data[("ATT&amp;CK Cache<br/>[mitre.json]")]
  node_attack_library["ATT&amp;CK Data<br/>[mitre.py]"]
end

node_user(("Engineer"))
node_attack_service["ATT&amp;CK Sources"]

node_user -->|"runs"| node_cli_entry
node_cli_entry -->|"starts commands"| node_cli_root
node_cli_root -->|"registers"| node_convert_cmd
node_cli_root -->|"registers"| node_transform_cmd
node_cli_root -->|"registers"| node_list_cmd
node_cli_root -->|"registers"| node_mitre_cmd
node_cli_root -->|"registers"| node_schema_cmd
node_cli_root -->|"registers"| node_validate_cmd
node_convert_cmd -->|"loads rules"| node_rule_schema
node_convert_cmd -->|"serializes rules"| node_serializer_framework
node_transform_cmd -->|"loads and writes"| node_rule_schema
node_transform_cmd -->|"applies transforms"| node_transforms
node_rule_schema -->|"parses conditions"| node_condition_grammar
node_serializer_framework -->|"applies transforms"| node_transforms
node_elastic_serializer -->|"implements serializer"| node_serializer_framework
node_elastic_serializer -->|"uses ATT&amp;CK data"| node_attack_library
node_list_cmd -->|"lists transforms"| node_transforms
node_list_cmd -->|"lists serializers"| node_serializer_framework
node_mitre_cmd -->|"manages cache"| node_attack_library
node_attack_library -->|"reads and writes"| node_attack_data
node_attack_library -->|"fetches data"| node_attack_service
node_schema_cmd -->|"inspects schema"| node_rule_schema
node_schema_cmd -->|"inspects schema"| node_serializer_framework
node_schema_cmd -->|"inspects schema"| node_transforms
node_validate_cmd -->|"validates rules"| node_rule_schema
node_validate_cmd -->|"validates serializers"| node_serializer_framework

click node_cli_entry "https://github.com/calebstewart/python-sigma/blob/main/sigma/__main__.py"
click node_cli_root "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/__init__.py"
click node_convert_cmd "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/converter.py"
click node_transform_cmd "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/transform.py"
click node_list_cmd "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/list.py"
click node_mitre_cmd "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/mitre.py"
click node_schema_cmd "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/schema.py"
click node_validate_cmd "https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/validate.py"
click node_rule_schema "https://github.com/calebstewart/python-sigma/blob/main/sigma/schema.py"
click node_condition_grammar "https://github.com/calebstewart/python-sigma/blob/main/sigma/grammar.py"
click node_transforms "https://github.com/calebstewart/python-sigma/tree/main/sigma/transform"
click node_serializer_framework "https://github.com/calebstewart/python-sigma/tree/main/sigma/serializer"
click node_elastic_serializer "https://github.com/calebstewart/python-sigma/blob/main/sigma/serializer/elastic.py"
click node_attack_data "https://github.com/calebstewart/python-sigma/blob/main/sigma/data/mitre.json"
click node_attack_library "https://github.com/calebstewart/python-sigma/blob/main/sigma/mitre.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_rule_schema,node_condition_grammar toneBlue
class node_transforms,node_serializer_framework,node_elastic_serializer toneAmber
class node_cli_entry,node_cli_root,node_convert_cmd,node_transform_cmd,node_list_cmd,node_mitre_cmd,node_schema_cmd,node_validate_cmd toneMint
class node_attack_data,node_attack_library toneRose
class node_user,node_attack_service toneIndigo
```

## Components

### Rule Model and Parsing

- [Rule Schema](https://github.com/calebstewart/python-sigma/blob/main/sigma/schema.py): `sigma/schema.py`
- [Condition Grammar](https://github.com/calebstewart/python-sigma/blob/main/sigma/grammar.py): `sigma/grammar.py`

### Transform and Serialize

- [Transformation Framework](https://github.com/calebstewart/python-sigma/tree/main/sigma/transform): `sigma/transform`
- [Serializer Framework](https://github.com/calebstewart/python-sigma/tree/main/sigma/serializer): `sigma/serializer`
- [Elastic Serializer](https://github.com/calebstewart/python-sigma/blob/main/sigma/serializer/elastic.py): `sigma/serializer/elastic.py`

### Command Line

- [Sigma CLI](https://github.com/calebstewart/python-sigma/blob/main/sigma/__main__.py): `sigma/__main__.py`
- [Command Registry](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/__init__.py): `sigma/cli/__init__.py`
- [Convert Rules](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/converter.py): `sigma/cli/converter.py`
- [Transform Rules](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/transform.py): `sigma/cli/transform.py`
- [List Capabilities](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/list.py): `sigma/cli/list.py`
- [MITRE Commands](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/mitre.py): `sigma/cli/mitre.py`
- [Schema Commands](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/schema.py): `sigma/cli/schema.py`
- [Validation Command](https://github.com/calebstewart/python-sigma/blob/main/sigma/cli/validate.py): `sigma/cli/validate.py`

### MITRE ATT&CK

- [ATT&CK Cache](https://github.com/calebstewart/python-sigma/blob/main/sigma/data/mitre.json): `sigma/data/mitre.json`
- [ATT&CK Data](https://github.com/calebstewart/python-sigma/blob/main/sigma/mitre.py): `sigma/mitre.py`

### Other components

- **Engineer**
- **ATT&CK Sources**

## Connections

- Engineer → Sigma CLI: runs (evidence: `README.md`)
- Sigma CLI → Command Registry: starts commands (evidence: `sigma/__main__.py`)
- Command Registry → Convert Rules: registers (evidence: `sigma/cli/__init__.py`)
- Command Registry → Transform Rules: registers (evidence: `sigma/cli/__init__.py`)
- Command Registry → List Capabilities: registers (evidence: `sigma/cli/__init__.py`)
- Command Registry → MITRE Commands: registers (evidence: `sigma/cli/__init__.py`)
- Command Registry → Schema Commands: registers (evidence: `sigma/cli/__init__.py`)
- Command Registry → Validation Command: registers (evidence: `sigma/cli/__init__.py`)
- Convert Rules → Rule Schema: loads rules (evidence: `sigma/cli/converter.py`)
- Convert Rules → Serializer Framework: serializes rules (evidence: `sigma/cli/converter.py`)
- Transform Rules → Rule Schema: loads and writes (evidence: `sigma/cli/transform.py`)
- Transform Rules → Transformation Framework: applies transforms (evidence: `sigma/cli/transform.py`)
- Rule Schema → Condition Grammar: parses conditions (evidence: `sigma/schema.py`)
- Serializer Framework → Transformation Framework: applies transforms (evidence: `sigma/serializer/__init__.py`)
- Elastic Serializer → Serializer Framework: implements serializer (evidence: `sigma/serializer/elastic.py`)
- Elastic Serializer → ATT&CK Data: uses ATT&CK data (evidence: `sigma/serializer/elastic.py`)
- List Capabilities → Transformation Framework: lists transforms (evidence: `sigma/cli/list.py`)
- List Capabilities → Serializer Framework: lists serializers (evidence: `sigma/cli/list.py`)
- MITRE Commands → ATT&CK Data: manages cache (evidence: `sigma/cli/mitre.py`)
- ATT&CK Data → ATT&CK Cache: reads and writes (evidence: `sigma/mitre.py`)
- ATT&CK Data → ATT&CK Sources: fetches data (evidence: `sigma/mitre.py`)
- Schema Commands → Rule Schema: inspects schema (evidence: `sigma/cli/schema.py`)
- Schema Commands → Serializer Framework: inspects schema (evidence: `sigma/cli/schema.py`)
- Schema Commands → Transformation Framework: inspects schema (evidence: `sigma/cli/schema.py`)
- Validation Command → Rule Schema: validates rules (evidence: `sigma/cli/validate.py`)
- Validation Command → Serializer Framework: validates serializers (evidence: `sigma/cli/validate.py`)