How sigmahq/sigma-cli works
Sigma CLI manages and validates Sigma rule collections, converts them into backend-specific queries, and provides analysis and plugin-management commands. The main workflow is a user invoking sigma convert on rule files, selecting installed backend and processing-pipeline plugins, then writing converted results. Other documented capabilities include rule checks, target and pipeline discovery, field/logsource/ATT&CK analysis, and pySigma data-cache management. The tree and excerpts support the command entry points and several key calls; links within unsampled command implementations are omitted where ownership is uncertain.
Main entry points: main.py Command entry · analyze.py Analysis commands · convert.py Convert rules · rules.py Rule loading
Components 20
CLI commands
- Command entry
sigma/cli/main.py - Rule checks
sigma/cli/check.py - Capability listing
sigma/cli/list.py - pySigma data tools
sigma/cli/pysigma.py
Rule conversion
- Convert rules
sigma/cli/convert.py - Rule loading
sigma/cli/rules.py - Processing pipelines
sigma/cli/convert.py
Rule analysis
- Analysis commands
sigma/cli/analyze.py - ATT&CK scoring
sigma/analyze/attack.py - Field extraction
sigma/analyze/fields.py - Logsource statistics
sigma/analyze/stats.py
Plugin ecosystem
- Query backend
- Plugin management
sigma/cli/plugin.py - Plugin discovery
Other components
- CLI user
- Sigma rule files
- Converted queries
- pySigma library
- Cached datasets
- Analysis reports
Connections 25
- CLI user → Command entry: invokes
- Command entry → Convert rules: dispatches
- Command entry → Rule checks: dispatches
- Command entry → Capability listing: dispatches
- Command entry → Plugin management: dispatches
- Command entry → Analysis commands: dispatches
- Command entry → pySigma data tools: dispatches
- CLI user → Sigma rule files: provides
- Convert rules → Rule loading: loads rules
- Rule loading → Sigma rule files: reads
- Convert rules → Processing pipelines: resolves pipelines
- Convert rules → Query backend: converts rules
- Convert rules → Converted queries: writes results
- Rule checks → Rule loading: loads rules
- Rule checks → pySigma library: validates rules
- Capability listing → Plugin discovery: discovers capabilities
- Plugin management → Plugin discovery: manages plugins
- Analysis commands → Rule loading: loads rules
- Analysis commands → ATT&CK scoring: scores coverage
- Analysis commands → Field extraction: extracts fields
- Analysis commands → Logsource statistics: counts logsources
- Analysis commands → Analysis reports: renders reports
- pySigma data tools → pySigma library: manages datasets
- pySigma library → Cached datasets: reads and writes
- Query backend → pySigma library: uses library