SIGMA – A Universal Detection Rule Language: From Basics To SIEM Integration v.2.2 is a comprehensive guide to understanding, writing, and operationalizing Sigma detection rules. Sigma has become the de facto standard for expressing log-based detections in a SIEM-agnostic way, enabling analysts to “write once, detect everywhere.” This publication explains the evolution of Sigma (from early YAML prototypes to the current 2.0 specification), the anatomy of Sigma rules, and practical steps to create, validate, and test detections. It covers tooling such as pySigma and sigma-cli, and shows how Sigma rules can be translated and deployed across multiple platforms including Splunk, Elastic, IBM QRadar, and Microsoft Sentinel. Advanced chapters explore performance tuning, false positive reduction, contextual correlation, enrichment strategies, and QA workflows. Real-world detection scenarios such as malicious PowerShell, credential dumping, lateral movement, and ransomware kill-chains are included, with examples of Sigma rules and their equivalents in native SIEM languages. The guide is aimed at SOC analysts, detection engineers, and threat hunters, providing both theoretical foundations and actionable techniques to build reliable, portable detections across diverse environments.