Writing · Pillar
Sigma & detection portability.
Sigma 2.0 correlations, pySigma backend reality, and Sigma as the fourth foundational standard alongside Iceberg, Arrow, and OCSF.
Depth tier for ch4 (Well-connected), Sigma as the fourth standard · 3 essays
Listed from the front door down to the measured evidence. Start here marks the entry essay. The reading-level tag says whether you are about to read the frame (Orientation), the argument (Depth), or the narrowest first-party finding (Evidence). The durability tag flags whether a number is durable architecture or an Evidence-pinned result tied to a version or price and meant to be re-run.
- Start here OrientationEvidence-pinned
Sigma and detection portability.
The fourth foundational standard. Why Sigma sits alongside Iceberg, Arrow, and OCSF as the standards that decouple security data from any single vendor's analytics engine.
Read →
- DepthEvidence-pinned
Why Sigma won the detection-sharing decade.
A decade of attempts to share security use cases — Sysmon configs, hunt notebooks, MITRE CAR, Atomic Red Team, Sigma — and only some endured. The difference wasn't quality; the best Sysmon config froze in 2021. Five structural properties predict what lasts, and Sigma has them by construction.
Read →
- EvidenceEvidence-pinned
Sigma 2.0 correlations and the pySigma backend reality.
Sigma 2.0 added correlation semantics that the backends haven't fully caught up to. Which backends ship the new constructs, which don't, and where that breaks in production.
Read →