Sigma rule
A generic, vendor-neutral rule format for log detection — "YARA for logs". A Sigma rule describes a suspicious pattern in log data in YAML, and can then be translated into the query language of any SIEM (Splunk, Elastic, Sentinel).
Problem: every SIEM/log tool has its own query language → a detection rule written for Splunk doesn't work in Elastic, and sharing between organizations becomes hard. Sigma solves it: write the rule once in a standardized YAML format ("if a process-creation event has image=powershell.exe and the command line contains -enc..."), and a converter translates it into the target tool's syntax. Win: sharing (the community publishes thousands of Sigma rules for known techniques, often mapped to MITRE ATT&CK), portability (switch SIEM without rewriting all the rules), and collaboration around detection. Distinct from YARA (which matches files/memory) — Sigma matches logs/events. Together they cover file- and log-based detection respectively. A de facto standard for shareable log detection. Related to YARA rule and MITRE ATT&CK tactic.