Skip to content
Sigmatic docs

Detection content

Sigmatic’s detection content is Sigma. You can write rules yourself, subscribe to packs, or both:

  • Sigma rules and Sigma correlation rules, each with immutable versions
  • rule pack subscriptions from SigmaHQ or any Git repository
  • field-mapping families for ECS and OCSF, so a pack’s field names resolve against your logs
  • ATT&CK coverage, including what enabling a subscribed pack would add

Test a rule against sample logs before you deploy it, and against a stretch of historical logs to see how often it would have fired.

Contributing content

Section titled “Contributing content”

Detection packs are Apache-2.0 content in the Sigmatic repository, with fixture tests beside them. Send changes there as small pull requests with a test for each rule; the contributor guides explain the layout.