A Sigma rule describes a behavior in YAML: the log source, the fields to match, and the conditions. Converters translate it into queries such as SPL for Splunk, KQL for Microsoft Sentinel and Defender, or Lucene for Elastic.
Why teams use Sigma
One rule can be reviewed, versioned and shared, then run across every tool the team owns. The open SigmaHQ repository holds thousands of community rules.
Where Sigma stops
Some questions need joins, aggregations or fields that Sigma can't express. Those are written in the tool's native language.