sigmatools

library0.23.1pypypi✓ verified 83d ago

Tools for the Generic Signature Format for SIEM Systems (sigma). Current version: 0.23.1. Quarterly releases with rule updates.

devops data

pip install sigmatools

github ↗package ↗

INSTALL

IMPORT

SIG · SIGMATOOLS

sigmatools

devopspythonv0.23.1

Install

4.9s avg

Import

—

Disk

34MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.23.1 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 35.1MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 4.9s · import 0.000s · 36MB

34MB installed

● package 34MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sigma

✓ import sigma

✗ import sigmatools

The package is 'sigmatools' but the import module is 'sigma'.

Convert a Sigma rule to Splunk SPL query.

import sigma from sigma.backends.splunk import SplunkBackend from sigma.collection import SigmaCollection rule_source = ''' title: Test Rule id: abcdef01-1234-5678-9abc-def012345678 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: 'test' condition: selection ''' rule = SigmaCollection.from_yaml(rule_source) backend = SplunkBackend() result = backend.convert(rule) print(result)

sigma --version

Debug

Known issues

breakingv0.20+ refactored the API: sigma.backends replaced sigma.backends.elasticsearch, sigma.backends.splunk, etc. Old imports like `from sigma.backends import splunk` no longer work; use `from sigma.backends.splunk import SplunkBackend`.

fix

Update imports to use new module paths: `from sigma.backends.<backend> import <BackendClass>`.

affects: <0.20

breakingIn v0.22, the CLI command changed from `sigma` to `sigmac`. The old `sigma` subcommands are deprecated.

fix

Use `sigmac` command for CLI operations.

affects: <0.22

gotchaSigmaCollection.from_yaml expects a YAML string, not a file path. To load from a file, you need to read it first.

fix

Use `with open('rule.yml') as f: SigmaCollection.from_yaml(f.read())`.

affects: all

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'sigma'

Installed 'sigmatools' but tried to import 'sigmatools' instead of 'sigma'.

fix

Use `import sigma` (the module name is 'sigma', not 'sigmatools').

AttributeError: module 'sigma' has no attribute 'backend'

After v0.20, the backend classes are under `sigma.backends.*`, not `sigma.backend`.

fix

Use `from sigma.backends.splunk import SplunkBackend` instead of `sigma.backend.SplunkBackend`.

sigma.exceptions.SigmaError: Logsource mapping not found: ...

When converting rules, the backend expects logsource mappings (e.g., for custom log sources).

fix

Ensure you have a proper logsource configuration or use `--output-config` with sigmac, or specify `backend.processing_pipeline`.

Upgrade

Version history

0.23.1latest on PyPI · released Apr 15, 2023

Audit

Dependencies

No dependency data recorded yet.

Agent activity

8 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/SigmaHQ/sigma ↗

packagehttps://pypi.org/project/sigmatools/ ↗