SigmaHQ Detection Rules
SigmaHQ Detection Rules
SigmaHQ's GitHub repository of vendor-neutral Sigma detection rules for log-based threat detection, as YAML files that Sigma tooling converts into SIEM and EDR queries.
Required Attribution:
Required: keep the rule author ("author" field) in shared rules and in messages based on rule matches.
Coverage
Community-maintained Sigma rules across Windows, Linux, macOS, cloud and network log sources. Update frequency: Not stated; the repository is updated through merged pull requests.
Verdict
Free YAML detection rules from GitHub. Licensed Custom (Detection Rule License 1.1): the licence says "Permission is hereby granted, free of charge, to any person obtaining a copy of this rule set and associated documentation files" to use, copy, modify, publish, distribute and sell the rules; for alerts it says: "If you use the Rules (including in modified form) on data, messages based on matches with the Rules must retain the following if it is supplied within the Rules:" (rule author identification). Rate limits: Not stated. Signal Lab links only.
Get the free weekly email
Free weekly email of newly verified free data. Unsubscribe by emailing us.
By entering your email and clicking Subscribe, you agree to receive the Signal Lab weekly email from Quantum Data Technologies Ltd., 3200-650 West Georgia Street, Vancouver, BC V6B 4P7, Canada (signal-lab@qdt.ai). You can unsubscribe at any time: reply "unsubscribe" to any email or write to signal-lab@qdt.ai. See our Privacy Policy.
Information and education only. Not financial, investment, legal or tax advice. Listings can be inaccurate, incomplete or out of date and are provided "as is". Free tiers, limits and licenses belong to each provider and can change, so check the provider's own terms before you rely on them. Terms & Disclaimer