Static Code Analysis
Compile a Sigma YAML folder to a SIEM query
Sigma YAML in, a SIEM query out.
overview
What sigma-cli does
sigma-cli reads a folder of Sigma YAML rules and compiles each rule for the SIEM named in --target.
A Managed-fleet smoke compiled a whoami process rule for Splunk. The row came back valid, with the query CommandLine="*whoami*".
Use this node to check that a rule compiles before a detection engine runs it over logs.
source github.com/SigmaHQ/sigma-cli
use cases
Where sigma-cli fits
Check a rule before deploy
Compile the YAML folder and keep only rows whose valid flag is true.
Produce a Splunk query
Set --target to splunk and take the query field from each row.
Review a rule pack
One JSON row per file makes a broken rule visible next to the ones that compiled.
reference
sigma-cli inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| rules | FOLDER | --rules | Folder of Sigma YAML rules. |
| target | STRING | --target | SIEM backend such as splunk or esql. |
Showing key inputs. sigma-cli exposes 2 inputs in total.
example
Run sigma-cli
sigma-cli --rules ./rules --target splunk{"rule_id": "8c1e2b3a-4d5e-4f60-9a7b-1c2d3e4f5061", "title": "Whoami Process", "valid": "true", "query": "CommandLine=\"*whoami*\""}guidance
Choosing sigma-cli
Use sigma-cli to compile Sigma YAML into a query. Use Zircolite when you already have JSON event logs to match.
zircolite
Matches Sigma rules against JSON event logs.
yara-x
Matches byte patterns in files rather than log queries.
semgrep-scan
Runs code rules against source, not SIEM queries.
faq
sigma-cli questions
related
More Static Code Analysis tools
bandit
Python source in, JSON security findings out.
gitleaks
Detect hardcoded secrets in git repos and plain directories.
gosec
Go AST security scanner for credentials, crypto, and injection.
guarddog
A package coordinate in, indicator hits out.
malcontent-scan
A package coordinate in, behavior findings out.
osv-malicious
A package coordinate in, malware advisory rows out.
Run sigma-cli yourself
A whoami Sigma rule compiled for Splunk with valid set to true and a CommandLine query.
Facts on this page come from the live Trickest tool library.