How are Sigma Rules versioned?

CTI Butler
1

I am using this query to get only the latest Sigma STIX objects

FOR doc IN sigma_rules_vertex_collection
    FILTER doc._is_latest == true
    RETURN [doc]

Currently there are versions

FOR doc IN sigma_rules_vertex_collection
    FILTER doc._stix2arango_note != "automatically imported on collection creation"
    RETURN DISTINCT doc._stix2arango_note

[
  "r2023-08-24",
  "r2023-10-09",
  "r2023-10-23",
  "r2023-11-06",
  "r2023-11-20",
  "r2023-12-04",
  "r2023-12-21",
  "r2024-01-15",
  "r2024-01-29",
  "r2024-02-12",
  "r2024-02-26",
  "r2024-03-11",
  "r2024-03-26",
  "r2024-04-29",
  "r2024-05-13"
]

But where do these versions come from?

2

The data is generated by sigma2stix

sigma2stix allows you to define a Github tag in the original Sigma repo, which is how the Sigma team version rulesets

For each version, sigma2stix generates a STIX bundle, which is then imported to CTI Butler, hence where the doc._stix2arango_note value comes from.