Detection Engineering

Write, convert, and validate detection logic — Sigma rules down to raw YARA signatures.

Sigma

rules

SigmaHQ's full rule corpus and tooling — a real git clone, so edit and branch freely.

Sigma specification

spec

The formal Sigma rule-format spec, for reference while writing new rules.

pySigma + sigma-cli

venv

Converts Sigma rules to real backend queries (Splunk, Elastic, and friends).

YARA

binary

The classic pattern-matching engine for files and memory.

YARA-X

binary

The Rust rewrite of YARA — faster, stricter rule parsing.

osquery

system

SQL-queryable endpoint telemetry — ask the OS questions like a database.