# sigmahq/sigma-cli architecture

> Architecture diagram of the GitHub repository sigmahq/sigma-cli, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/sigmahq/sigma-cli
- Repository: https://github.com/sigmahq/sigma-cli

## Overview

Sigma CLI manages and validates Sigma rule collections, converts them into backend-specific queries, and provides analysis and plugin-management commands. The main workflow is a user invoking `sigma convert` on rule files, selecting installed backend and processing-pipeline plugins, then writing converted results. Other documented capabilities include rule checks, target and pipeline discovery, field/logsource/ATT&CK analysis, and pySigma data-cache management. The tree and excerpts support the command entry points and several key calls; links within unsampled command implementations are omitted where ownership is uncertain.

Main entry points: [`sigma/cli/main.py`](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/main.py) (Command entry), [`sigma/cli/analyze.py`](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/analyze.py) (Analysis commands), [`sigma/cli/convert.py`](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/convert.py) (Convert rules), [`sigma/cli/rules.py`](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/rules.py) (Rule loading)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_commands["CLI commands"]
  node_entry["Command entry<br/>[main.py]"]
  node_check["Rule checks<br/>[check.py]"]
  node_list["Capability listing<br/>[list.py]"]
  node_pysigma_admin["pySigma data tools<br/>[pysigma.py]"]
end

subgraph group_conversion["Rule conversion"]
  node_convert["Convert rules<br/>[convert.py]"]
  node_rule_loader["Rule loading<br/>[rules.py]"]
  node_processing["Processing pipelines<br/>[convert.py]"]
end

subgraph group_analysis["Rule analysis"]
  node_analyze["Analysis commands<br/>[analyze.py]"]
  node_attack["ATT&amp;CK scoring<br/>[attack.py]"]
  node_fields["Field extraction<br/>[fields.py]"]
  node_stats["Logsource statistics<br/>[stats.py]"]
end

subgraph group_plugins["Plugin ecosystem"]
  node_backend["Query backend"]
  node_plugin_cmd["Plugin management<br/>[plugin.py]"]
  node_plugin_registry["Plugin discovery"]
end

node_user(("CLI user"))
node_sigma_rules["Sigma rule files"]
node_converted["Converted queries"]
node_pysigma["pySigma library"]
node_cache_data[("Cached datasets")]
node_output["Analysis reports"]

node_user -->|"invokes"| node_entry
node_entry -->|"dispatches"| node_convert
node_entry -->|"dispatches"| node_check
node_entry -->|"dispatches"| node_list
node_entry -->|"dispatches"| node_plugin_cmd
node_entry -->|"dispatches"| node_analyze
node_entry -->|"dispatches"| node_pysigma_admin
node_user -->|"provides"| node_sigma_rules
node_convert -->|"loads rules"| node_rule_loader
node_rule_loader -->|"reads"| node_sigma_rules
node_convert -->|"resolves pipelines"| node_processing
node_convert -->|"converts rules"| node_backend
node_convert -->|"writes results"| node_converted
node_check -->|"loads rules"| node_rule_loader
node_check -->|"validates rules"| node_pysigma
node_list -->|"discovers capabilities"| node_plugin_registry
node_plugin_cmd -->|"manages plugins"| node_plugin_registry
node_analyze -->|"loads rules"| node_rule_loader
node_analyze -->|"scores coverage"| node_attack
node_analyze -->|"extracts fields"| node_fields
node_analyze -->|"counts logsources"| node_stats
node_analyze -->|"renders reports"| node_output
node_pysigma_admin -->|"manages datasets"| node_pysigma
node_pysigma -->|"reads and writes"| node_cache_data
node_backend -->|"uses library"| node_pysigma

click node_entry "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/main.py"
click node_convert "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/convert.py"
click node_rule_loader "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/rules.py"
click node_processing "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/convert.py"
click node_check "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/check.py"
click node_list "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/list.py"
click node_plugin_cmd "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/plugin.py"
click node_analyze "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/analyze.py"
click node_attack "https://github.com/sigmahq/sigma-cli/blob/main/sigma/analyze/attack.py"
click node_fields "https://github.com/sigmahq/sigma-cli/blob/main/sigma/analyze/fields.py"
click node_stats "https://github.com/sigmahq/sigma-cli/blob/main/sigma/analyze/stats.py"
click node_pysigma_admin "https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/pysigma.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_check,node_list,node_pysigma_admin,node_user toneBlue
class node_convert,node_rule_loader,node_processing,node_cache_data toneAmber
class node_analyze,node_attack,node_fields,node_stats toneMint
class node_backend,node_plugin_cmd,node_plugin_registry toneRose
class node_sigma_rules,node_converted,node_pysigma,node_output toneIndigo
```

## Components

### CLI commands

- [Command entry](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/main.py): `sigma/cli/main.py`
- [Rule checks](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/check.py): `sigma/cli/check.py`
- [Capability listing](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/list.py): `sigma/cli/list.py`
- [pySigma data tools](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/pysigma.py): `sigma/cli/pysigma.py`

### Rule conversion

- [Convert rules](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/convert.py): `sigma/cli/convert.py`
- [Rule loading](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/rules.py): `sigma/cli/rules.py`
- [Processing pipelines](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/convert.py): `sigma/cli/convert.py`

### Rule analysis

- [Analysis commands](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/analyze.py): `sigma/cli/analyze.py`
- [ATT&CK scoring](https://github.com/sigmahq/sigma-cli/blob/main/sigma/analyze/attack.py): `sigma/analyze/attack.py`
- [Field extraction](https://github.com/sigmahq/sigma-cli/blob/main/sigma/analyze/fields.py): `sigma/analyze/fields.py`
- [Logsource statistics](https://github.com/sigmahq/sigma-cli/blob/main/sigma/analyze/stats.py): `sigma/analyze/stats.py`

### Plugin ecosystem

- **Query backend**
- [Plugin management](https://github.com/sigmahq/sigma-cli/blob/main/sigma/cli/plugin.py): `sigma/cli/plugin.py`
- **Plugin discovery**

### Other components

- **CLI user**
- **Sigma rule files**
- **Converted queries**
- **pySigma library**
- **Cached datasets**
- **Analysis reports**

## Connections

- CLI user → Command entry: invokes
- Command entry → Convert rules: dispatches
- Command entry → Rule checks: dispatches
- Command entry → Capability listing: dispatches
- Command entry → Plugin management: dispatches
- Command entry → Analysis commands: dispatches
- Command entry → pySigma data tools: dispatches
- CLI user → Sigma rule files: provides
- Convert rules → Rule loading: loads rules
- Rule loading → Sigma rule files: reads
- Convert rules → Processing pipelines: resolves pipelines
- Convert rules → Query backend: converts rules
- Convert rules → Converted queries: writes results
- Rule checks → Rule loading: loads rules
- Rule checks → pySigma library: validates rules
- Capability listing → Plugin discovery: discovers capabilities
- Plugin management → Plugin discovery: manages plugins
- Analysis commands → Rule loading: loads rules
- Analysis commands → ATT&CK scoring: scores coverage
- Analysis commands → Field extraction: extracts fields
- Analysis commands → Logsource statistics: counts logsources
- Analysis commands → Analysis reports: renders reports
- pySigma data tools → pySigma library: manages datasets
- pySigma library → Cached datasets: reads and writes
- Query backend → pySigma library: uses library