Structure of the Policy File

Sigma Documentation

Version
latest

The basic structure of the file looks like this:

version: <VERSION_NUMBER>
policies:
	- <POLICY_RULE>
		...
	- <POLICY_RULE>
		...
	- <POLICY_RULE>
  • The VERSION_NUMBER is the version of the policy file format.

  • The policies field is a collection of policy rules.

A policy rule has the following structure:

- <POLICY_RULE>
	-> id: <UNIQUE_IDENTIFIER>
	|
	-> when: 
		|
		-> <WHEN_NODE>
	|
	-> result: 
		|
		-> <RESULT_NODE>

The id field identifies the policy rule. You can use whatever value you prefer; it is treated as a string.