How sigmahq/pysigma works
pySigma is a vendor-agnostic Python library for parsing Sigma rules and converting them into backend queries. The principal workflow is rule input → rule and detection model → optional validation and processing transformations → backend conversion → query output. Correlation rules, reusable log-source pipelines, modifiers, and plugin-provided backends are distinct capabilities. The excerpts are partial, so connections are limited to the documented workflow and visible module responsibilities; no command-line consumer is shown in this repository tree.
Main entry points: pipeline.py Processing pipeline · base.py Backend converter · collection.py Rule collection · rule.py Sigma rules
Components 22
Rule model
- Rule collection
sigma/collection.py - Sigma rules
sigma/rule/rule.py - Detections
sigma/rule/detection.py - Condition expressions
sigma/conditions.py - Correlation rules
sigma/correlations.py - Value modifiers
sigma/modifiers.py
Processing
- Processing pipeline
sigma/processing/pipeline.py - Processing conditions
sigma/processing/conditions/base.py - Transformations
sigma/processing/transformations/base.py - Common pipelines
sigma/pipelines/common.py
Conversion
- Backend converter
sigma/conversion/base.py - Conversion state
sigma/conversion/state.py - Deferred queries
sigma/conversion/deferred.py - Plugin registry
sigma/plugins.py
Validation
- Validation framework
sigma/validators/base.py - Core validators
sigma/validators/core/condition.py - Tag validation
sigma/validators/core/tags.py - ATT&CK data
sigma/data/mitre_attack.py - D3FEND data
sigma/data/mitre_d3fend.py
Other components
- Rule provider
- Backend extensions
- Converted queries
Connections 21
- Rule provider → Rule collection: provides rules
- Rule collection → Sigma rules: holds rules
- Sigma rules → Detections: contains detections
- Detections → Value modifiers: applies modifiers
- Sigma rules → Condition expressions: defines conditions
- Rule collection → Correlation rules: includes correlations
- Rule collection → Validation framework: can validate
- Validation framework → Core validators: runs checks
- Validation framework → Tag validation: runs checks
- Tag validation → ATT&CK data: checks tags
- Tag validation → D3FEND data: checks tags
- Sigma rules → Processing pipeline: enters processing
- Processing pipeline → Processing conditions: evaluates conditions
- Processing pipeline → Transformations: applies transformations
- Common pipelines → Processing pipeline: provides items
- Processing pipeline → Backend converter: prepares rules
- Backend converter → Conversion state: tracks conversion
- Backend converter → Deferred queries: handles deferred queries
- Backend converter → Converted queries: renders queries
- Plugin registry → Backend extensions: discovers extensions
- Backend extensions → Backend converter: extends conversion