Open cardosec

Case 89A6E5 · Blue team / DFIR · L2 Practitioner

Sigma Rules

Practise as: Explain it · InterviewLevel: L2 Practitioner

Interview questionWhat is Sigma, and why would a team write detections in it instead of directly in their SIEM?

  1. 01 What is it?
  2. 02 How is it abused?
  3. 03 How do you stop it?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Sigma is a vendor-neutral YAML format for log detections: a logsource, named selections of field matches, and a condition combining them.
  2. Tools (pySigma and its backends) convert rules into a SIEM query language such as Splunk SPL, Microsoft KQL or Elastic queries.
  3. Benefits: share and review rules as text, reuse community rules, and avoid lock-in when the SIEM changes.
  4. Limits: field names and log sources must be mapped to your data, and complex correlations may not convert cleanly.

If the interviewer pushes back

  • A community Sigma rule converts fine but never fires in your SIEM. What are the likely causes?

Go deeper

More Blue team / DFIR cards

All Blue team / DFIR cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09