Sigma Python Packages

tenzir

Tenzir is the data pipeline engine for security teams.

pysigma-backend-loki

pySigma backend for generating Grafana Loki/LogQL rules

pysigma-backend-netwitness

pySigma NetWitness backend

pyvast

Tenzir is the data pipeline engine for security teams.

sigma-rule-matcher

Python tool for evaluating Sigma rules against events

mcp-server-sigma

Enterprise Model Context Protocol (MCP) server for Sigma Computing — provision dashboards, construct data models, and automate cloud analytics.

detect-droid

A pySigma wrapper to manage detection rules.

pysigma-backend-varpulis

pySigma backend for Varpulis VPL: Sigma rules, correlation rules included, as detection streams

azuma

Yet another Sigma library for Python

pysigma-backend-sumologic

pySigma backend for Sumo Logic Cloud SIEM rule conversion

pysigma-backend-databricks

pySigma Databricks backend

pysigma-backend-uberagent

uberAgent backend for the Sigma rule converter.

pysigma-backend-victorialogs

pySigma backend that converts Sigma detection rules to LogsQL queries for VictoriaLogs

malwagon

Scan a file for malware from your terminal. Automated malware analysis sandbox CLI with hypervisor-level agentless dynamic analysis, BYOVD kernel driver analysis and AI-assisted reporting. pip install malwagon

redgap

Automated MITRE ATT&CK offense-detection coverage harness - deterministic, no AI in the verdict.

bedrock-keys-security

Detect phantom IAM users, decode leaked AWS Bedrock and Claude Platform API keys, and prevent LLMjacking. CLI + SCPs + SIEM detection rules.

tracesig

Sigma-style detection rules for AI agent tool-call traces: 23 provenance, taint and sequence rules. Scans Claude Code sessions and agent-policy-gateway audit logs; works on any agent's JSONL trace.

automathon

A Python library for simulating and visualizing finite automata

detect-forge

Open-source AI validation for detection rules. Tests whether your Sigma/Elastic rules still catch what they claim. Runs in CI, nothing leaves your environment.

emsigma

Python code for phase identification and spectrum analysis of energy dispersive x-ray spectroscopy (EDS)

pytenzir

Tenzir is the data pipeline engine for security teams.

sigmalint-cli

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

attack-mapper

Map Sigma detection rules onto MITRE ATT&CK v19 and gate your CI on detection coverage

detection-forge

AI-assisted detection engineering: rule generation and validation workflows