Overview#
A national CERT receives a threat intelligence report describing a new persistence technique used by a financially motivated APT group: registry run-key modification combined with a renamed PowerShell binary. Within two hours, the detection engineering team has translated a Sigma rule from the community SigmaHQ repository, validated it against their Splunk SPL backend, and pushed it to production. Three days later, the same team onboards a second SIEM running Elastic. Because Sigma is the canonical source, they generate the Elastic ESQL variant in seconds, with no rewriting required.
Argus integrates a full Sigma detection rule management system, letting analysts import, manage, and translate Sigma rules: the vendor-neutral SIEM detection language used by the security community and recommended by MITRE ATT&CK contributors. Rules can be imported from YAML, bulk-imported from repositories, and translated into backend-specific query languages via pySigma. Rule import operations generate EDF-compliant audit records, ensuring detection changes are traceable for compliance and operational review.
Key Features#
Sigma YAML Import#
Load individual Sigma rules from raw YAML text via the importSigmaRule mutation. The parse_sigma_rule_yaml adapter validates and extracts rule metadata including title, description, false positives, log source, detection conditions, and level (informational through critical). Invalid YAML is rejected with detailed parse errors logged at the service layer rather than surfaced to callers, preventing error disclosure that could assist an adversary in fingerprinting the platform.
Bulk Rule Import#
Import entire Sigma rule repositories in a single operation via the importSigmaRulesBulk mutation, batch-processing hundreds of rules while collecting success and failure counts per rule. This is particularly useful for onboarding an organisation from an existing detection-as-code repository or bootstrapping coverage from public repositories like the SigmaHQ community rules set maintained by contributors across the security industry.
pySigma Translation to SIEM Backends#
Translate stored Sigma rules to backend-specific query languages using pySigma via the translateSigmaRule mutation. Supported backends include Splunk SPL, Elastic ESQL and Lucene, Microsoft Sentinel KQL, Chronicle YARA-L, and QRadar AQL. Translation happens on demand, meaning the canonical Sigma YAML is always the source of truth and queries can be regenerated for new backends without maintaining separate rule copies or risking drift between environments.
On-Demand Translation Validation#
Validate raw Sigma YAML with validateSigmaRule, translate stored rules with translateSigmaRule, and translate ad hoc YAML content with translateSigmaRuleYaml. This flexibility supports detection engineers who need to test rules before committing them to the library, as well as automated pipelines that validate rules as part of a CI/CD workflow.
Rule Inventory and Statistics#
Query the rule inventory by organisation with filtering by severity level, log source category, or status. The sigmaStats query returns counts by level (critical, high, medium, low, informational), giving security operations teams visibility into their detection coverage distribution and highlighting where tuning or new rule development is needed.
Use Cases#
- Detection-as-Code Workflow: Import a Git repository's Sigma rule set on deployment and translate to the production SIEM backend, treating detection rules as managed infrastructure versioned alongside playbooks and runbooks. This approach brings software engineering discipline to detection engineering.
- Multi-SIEM Organisations: Maintain a single Sigma rule library in Argus and generate translated variants for Splunk, Elastic, and Sentinel without managing backend-specific copies. Organisations running hybrid SIEM environments, which is common after mergers or in large enterprise environments, avoid the maintenance overhead of divergent rule sets.
- ATT&CK Coverage Mapping: Tag imported rules with MITRE ATT&CK technique IDs and report on technique coverage gaps across the detection rule library, informing prioritisation of new detection development aligned to the threat actor TTPs most relevant to the organisation.
- Partner Rule Sharing: Export Sigma rules as vendor-neutral YAML to share with allied organisations without exposing proprietary SIEM query syntax. This is standard practice in defence and government sharing communities where recipients operate diverse SIEM stacks.
Integration#
Available via GraphQL: sigmaRules, sigmaStats (queries); importSigmaRule, importSigmaRulesBulk, translateSigmaRule, translateSigmaRuleYaml, validateSigmaRule (mutations). All operations require authentication and organisation scoping.
Compatible with Sigma specification v2 and above, with pySigma backends for all major SIEM platforms. Works alongside the SIEM Connector domain for persistent SIEM connection management, and integrates with the MISP and STIX domains to derive detection rules from observed indicators.
Open Standards#
- Sigma Detection Rule Specification (v2): Rules are authored, stored, and validated as YAML conforming to the Sigma open specification, enforcing required fields (title, logsource, detection, condition), severity vocabulary (informational through critical), and status lifecycle values.
- MITRE ATT&CK: Rule tags are parsed for ATT&CK technique and sub-technique identifiers (T-number format), enabling automated coverage gap analysis aligned to the threat actor TTP taxonomy maintained by MITRE.
- OASIS STIX 2.1 / TAXII 2.1: The Sigma engine integrates with the platform STIX domain to derive detection rules from ingested STIX Indicator and Threat Actor objects, consuming feeds delivered over TAXII 2.1 collections.
- YAML 1.2: Sigma rule content is serialised, parsed, and re-serialised using the YAML 1.2 data format; the adapter validates structure against the Sigma schema before persisting or translating rules.
- Splunk SPL (Search Processing Language): Rules are translated on demand into Splunk SPL via the pySigma SplunkBackend, producing native search queries for deployment to Splunk Enterprise and Splunk Cloud.
- Elastic Lucene / ESQL and OpenSearch Query DSL: Rules are translated to Apache Lucene query syntax and Elastic ESQL for Elasticsearch and OpenSearch SIEM deployments via the pySigma LuceneBackend.
- GraphQL (June 2018 specification): All rule management operations, including import, bulk import, translation, validation, and statistics queries, are exposed as typed GraphQL queries and mutations requiring authenticated, organisation-scoped sessions.
Last Reviewed: 2026-03-18 Last Updated: 2026-04-14