Sigma Rules Python Packages

pyatr

Open detection-rule standard for AI agent security threats — like Sigma, but for AI agents. Executable, testable rules for prompt injection, tool poisoning, context exfiltration and MCP attacks. Merged into open-source projects at Microsoft, Cisco, Gen Digital, MISP and FINOS. MIT-licensed.

pysigma-backend-uberagent

uberAgent backend for the Sigma rule converter.

contrastapi

MCP server with 55 security intelligence tools — CVE/KEV, MITRE ATLAS+D3FEND, Sigma detection rules, email security posture (SPF/DMARC), domain & web intel, threat intel.

sigmalint-cli

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

mitre-attackctl

A fast, batteries-included CLI companion for MITRE ATT&CK® TTPs.

sigmawarden

Lints a folder of Sigma detection rules for the mistakes that don't show up until someone tries to deploy them