Sigmatic

Sigmatic runs Sigma detection rules against logs in OpenSearch and raises alerts when they match. It also manages threat intelligence, hunting, and the health of the OpenSearch cluster it runs on.

With Sigmatic you can:

• write Sigma rules and Sigma correlation rules, test them against sample and historical logs, and deploy them
• subscribe to rule packs from SigmaHQ or a Git repository
• map Sigma fields onto your log fields, with ECS and OCSF presets
• see which ATT&CK techniques your deployed rules cover
• pull indicators from MISP, TAXII 2.1, OpenCTI and STIX feeds, and match them against incoming logs
• take logs pushed by shippers, or read indices already in OpenSearch

Start here

1. Install Sigmatic on one host, with its bundled OpenSearch.
2. Send logs from your shippers to a data source.
3. Add or subscribe to detection content.

To script Sigmatic, read the API page.

Before you turn on Sigmatic’s AI features, read AI features for what they send to your model and how to switch them off.