{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Sigma Meta rule specification V2.1.0 (2025-07-25)",
  "type": "object",
  "required": ["title", "correlation"],
  "properties": {
    "title": {
      "type": "string",
      "maxLength": 256,
      "description": "A brief title for the rule that should contain what the rule is supposed to detect"
    },
    "id": {
      "type": "string",
      "description": "A globally unique identifier for the Sigma rule. This is recommended to be a UUID v4, but not mandatory.",
      "format": "uuid"
    },
    "status": {
      "type": "string",
      "oneOf": [
        {
          "const": "stable",
          "description": "The rule didn't produce any obvious false positives in multiple environments over a long period of time"
        },
        {
          "const": "test",
          "description": "The rule doesn't show any obvious false positives on a limited set of test systems"
        },
        {
          "const": "experimental",
          "description": "A new rule that hasn't been tested outside of lab environments and could lead to many false positives"
        },
        {
          "const": "deprecated",
          "description": "The rule was replaced or is now covered by another one. The link between both rules is made via the `related` field"
        },
        {
          "const": "unsupported",
          "description": "The rule can not be used in its current state (special correlation log, home-made fields, etc.)"
        }
      ]
    },
    "description": {
      "type": "string",
      "description": "A short description of the rule and the malicious activity that can be detected",
      "maxLength": 65535
    },
    "author": {
      "type": "string",
      "description": "Creator of the rule. (can be a name, nickname, twitter handle, etc.)"
    },
    "references": {
      "type": "array",
      "description": "References to the source that the rule was derived from. These could be blog articles, technical papers, presentations or even tweets",
      "uniqueItems": true,
      "items": {
        "type": "string"
      }
    },
    "date": {
      "type": "string",
      "description": "Creation date of the meta rule. Use the ISO 8601 format YYYY-MM-DD",
      "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
    },
    "modified": {
      "type": "string",
      "description": "Last modification date of the meta rule. Use the ISO 8601 format YYYY-MM-DD",
      "pattern": "^\\d{4}-(0[1-9]|1[012])-(0[1-9]|[12][0-9]|3[01])$"
    },
    "taxonomy": {
      "type": "string",
      "maxLength": 256,
      "description": "Defines the taxonomy used in the Sigma correlation rule"
    },
    "correlation": {
      "type": "object",
      "required": ["type", "rules", "timespan"],
      "description": "Represents the correlation searched for on the log data",
      "properties": {
        "type": {
          "type": "string",
          "maxLength": 16,
          "description": "Defines the correlation type",
          "oneOf": [
            {
              "const": "event_count"
            },
            {
              "const": "temporal"
            },
            {
              "const": "temporal_ordered"
            },
            {
              "const": "value_count"
            },
            {
              "const": "value_sum"
            },
            {
              "const": "value_avg"
            },
            {
              "const": "value_percentile"
            }
          ]
        },
        "rules": {
          "description": "Refers to one or multiple Sigma or Correlations rules",
          "uniqueItems": true,
          "anyOf": [
            {
              "type": "array",
              "items": {
                "anyOf": [
                  {
                    "type": "string",
                    "minLength": 2
                  },
                  {
                    "type": "string",
                    "format": "uuid"
                  }
                ]
              }
            }
          ]
        },
        "aliases": {
          "type": "object",
          "description": "Defines field name aliases that are applied to correlated Sigma rules",
          "additionalProperties": {
            "anyOf": [
              {
                "type": "object",
                "items": {
                  "type": "string"
                }
              }
            ]
          }
        },
        "group-by": {
          "type": "array",
          "description": "Defines one or multiple fields which should be treated as separate event occurrence scope",
          "uniqueItems": true,
          "items": {
            "type": "string"
          }
        },
        "timespan": {
          "type": "string",
          "maxLength": 10,
          "description": "Defines a time period in which the correlation should be applied. Used: `number + letter (in lowercase)`"
        },
        "condition": {
          "type": "object",
          "description": "The condition defines when a correlation matches",
          "uniqueItems": true,
          "minItems": 1,
          "maxItems": 3,
          "anyOf": [
            {
              "gt": {
                "description": "The count must be greater than the given value",
                "type": "integer"
              }
            },
            {
              "gte": {
                "description": "The count must be greater than or equal to the given value",
                "type": "integer"
              }
            },
            {
              "lt": {
                "description": "The count must be lesser than the given value",
                "type": "integer"
              }
            },
            {
              "lte": {
                "description": "The count must be lesser than or equal to the given value",
                "type": "integer"
              }
            },
            {
              "eq": {
                "description": "The count must be equal to the given value",
                "type": "integer"
              }
            },
            {
              "neq": {
                "description": "The count must different to the given value",
                "type": "integer"
              }
            },
            {
              "field": {
                "description": "Name of the field(s) to count values",
                "anyOf": [
                  {
                    "type": "string",
                    "maxLength": 256
                  },
                  {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "maxLength": 256
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      "allOf": [
        {
          "if": { "properties": { "type": { "const": "event_count" } } },
          "then": { "required": ["condition", "group-by", "timespan"] }
        },
        {
          "if": { "properties": { "type": { "const": "temporal" } } },
          "then": { "required": ["group-by", "timespan"] }
        },
        {
          "if": { "properties": { "type": { "const": "temporal_ordered" } } },
          "then": { "required": ["group-by", "timespan"] }
        },
        {
          "if": { "properties": { "type": { "const": "value_count" } } },
          "then": {
            "condition": {
              "type": "object",
              "properties": { "field": { "type": "string" } },
              "required": ["field"]
            },
            "required": ["condition", "group-by", "timespan"]
          }
        },
        {
          "if": { "properties": { "type": { "const": "value_sum" } } },
          "then": {
            "condition": {
              "type": "object",
              "properties": { "field": { "type": "string" } },
              "required": ["field"]
            },
            "required": ["condition", "group-by", "timespan"]
          }
        },
        {
          "if": { "properties": { "type": { "const": "value_avg" } } },
          "then": {
            "condition": {
              "type": "object",
              "properties": { "field": { "type": "string" } },
              "required": ["field"]
            },
            "required": ["condition", "group-by", "timespan"]
          }
        },
        {
          "if": { "properties": { "type": { "const": "value_percentile" } } },
          "then": {
            "condition": {
              "type": "object",
              "properties": { "field": { "type": "string" } },
              "required": ["field"]
            },
            "required": ["condition", "group-by", "timespan"]
          }
        }
      ]
    },
    "falsepositives": {
      "description": "A list of known false positives that may occur",
      "uniqueItems": true,
      "anyOf": [
        {
          "type": "string",
          "minLength": 2
        },
        {
          "type": "array",
          "items": {
            "type": "string",
            "minLength": 2
          }
        }
      ]
    },
    "level": {
      "type": "string",
      "description": "The criticality of a triggered rule",
      "oneOf": [
        {
          "const": "informational",
          "description": "Rule is intended for enrichment of events, e.g. by tagging them. No case or alerting should be triggered by such rules because it is expected that a huge amount of events will match these rules"
        },
        {
          "const": "low",
          "description": "Notable event but rarely an incident. Low-rated events can be relevant in high numbers or in combination with others. Immediate reaction shouldn't be necessary, but a regular review is recommended"
        },
        {
          "const": "medium",
          "description": "Relevant event that should be reviewed manually on a more frequent basis"
        },
        {
          "const": "high",
          "description": "Relevant event that should trigger an internal alert and requires a prompt review"
        },
        {
          "const": "critical",
          "description": "Highly relevant event that indicates an incident. Critical events should be reviewed immediately. It is used only for cases in which probability borders certainty"
        }
      ]
    },
    "generate": {
      "type": "boolean",
      "description": "Defines if the rules referred to by the correlation rule should be converted into stand-alone rules"
    }
  }
}