mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2.1 KiB
2.1 KiB
API Reference: Building Detection Rules with Sigma
pySigma (sigma-cli)
from sigma.rule import SigmaRule
from sigma.collection import SigmaCollection
from sigma.backends.splunk import SplunkBackend
from sigma.pipelines.splunk import splunk_windows_pipeline
# Load and parse a Sigma rule
rule = SigmaRule.from_yaml(open("rule.yml").read())
print(rule.title, rule.id, rule.level, rule.status)
# Convert to Splunk SPL
pipeline = splunk_windows_pipeline()
backend = SplunkBackend(pipeline)
queries = backend.convert_rule(rule)
for q in queries:
print(q)
# Saved search output format
saved = backend.convert_rule(rule, output_format="savedsearches")
# Batch convert a collection
collection = SigmaCollection.load_ruleset(["./rules/"])
output = backend.convert(collection)
Key Sigma Rule Fields
| Field | Required | Description |
|---|---|---|
title |
Yes | Short rule name |
id |
Yes | UUID for the rule |
status |
Yes | test, experimental, stable |
level |
Yes | informational, low, medium, high, critical |
logsource |
Yes | category, product, service |
detection |
Yes | Selection + condition logic |
tags |
No | ATT&CK tags (attack.tXXXX) |
Available Backends (pySigma)
| Package | Backend | Target |
|---|---|---|
pySigma-backend-splunk |
SplunkBackend |
Splunk SPL |
pySigma-backend-elasticsearch |
LuceneBackend |
Elastic/OpenSearch |
pySigma-backend-microsoft365defender |
Microsoft365DefenderBackend |
KQL |
pySigma-backend-qradar |
QRadarBackend |
AQL |
sigma-cli Commands
# Convert single rule
sigma convert -t splunk -p splunk_windows rule.yml
# Convert directory
sigma convert -t splunk -p splunk_windows ./rules/ -o output.txt
# List backends and pipelines
sigma list backends
sigma list pipelines
# Validate a rule
sigma check rule.yml
References
- pySigma: https://github.com/SigmaHQ/pySigma
- sigma-cli: https://github.com/SigmaHQ/sigma-cli
- Sigma rules repo: https://github.com/SigmaHQ/sigma
- SigmaHQ docs: https://sigmahq.io/docs/guide/getting-started.html