<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-sigma-rule-development
description: >-
  Author, validate, convert, and manage Sigma detection rules for
  cross-SIEM deployment including advanced patterns, field modifiers,
  correlation rules, and backend optimization.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - sigma-rules
  - detection-rules
  - siem-queries
  - rule-authoring
  - cross-platform
  - rule-conversion
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Sigma Rule Development

## Overview

Sigma rule development is the core detection engineering skill.
Covers advanced authoring patterns, field modifiers, correlation rules,
backend-specific optimization, and lifecycle management.

## Prerequisites

| Requirement | Purpose |
|---|---|
| sigma-cli | `pip install sigma-cli` |
| pySigma backends | Backend plugins for target SIEMs |
| Log source knowledge | Available telemetry and field mappings |

## Key Concepts

### Advanced Sigma Patterns

```yaml
# Sigma correlation rule
title: Brute Force Followed by Successful Logon
id: 7b2c4d5e-9f1a-4b3c-8d6e-2a1f5c7d9e0b
status: experimental
logsource:
  category: authentication
  product: windows
detection:
  failed:
    EventID: 4625
  success:
    EventID: 4624
    LogonType: 10
  condition: failed | count(TargetUserName) by IpAddress > 5 | near success
  timeframe: 15m
level: high
tags:
  - attack.credential_access
  - attack.t1110.001
```

## Workflow

1. **Identify technique** — Map ATT&CK technique to telemetry
2. **Research log sources** — Available fields and event IDs
3. **Author rule** — Detection logic with appropriate modifiers
4. **Validate syntax** — `sigma check rule.yml`
5. **Convert and test** — Convert to target SIEM, test with samples
6. **Tune for FPs** — Add environment-specific filters
7. **Deploy and monitor** — Push to production, track quality

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
