Sigma rules, translated in the browser
Sigma is the lingua franca of detection engineering: a vendor-neutral YAML format for describing suspicious activity in log data. The SigmaHQ rule repository hosts thousands of community detections, but deploying them means translating each rule into your SIEM’s query language.
That translation step is where friction piles up. The canonical toolchain is pySigma, a Python library with pluggable backends for Splunk, Elasticsearch, Kusto, and dozens more. Powerful, but overkill when you just want to preview how a rule looks in Splunk SPL before committing it to a repo.
Convert Sigma rules to Splunk SPL, Elastic Lucene, or Microsoft KQL using pySigma in your browser. The first load downloads the Python runtime and backends once; later conversions are much faster.
Hover or tab here to preload quietly in the background.
Paste a Sigma rule, pick Splunk SPL, Elastic / Lucene, or Microsoft KQL, and click Convert. The first run downloads Pyodide and the pySigma backends; after that, conversions are fast and stay local. Source lives in the monorepo at lab-sigma-translate.
Field names are the catch
Sigma rules default to Sysmon-style field names like Image and CommandLine.
Your SIEM probably uses something different: ECS (process.executable), Splunk
CIM (Processes.process_path), or vendor schemas like Defender’s
DeviceProcessEvents. The converter gives you a starting point, not a
drop-in query. Always verify field mappings against your data source before
deploying.
For production pipelines with custom field maps and logsource transforms, reach for sigma-cli locally. This garden tool is for quick previews and learning, not CI/CD rule deployment.
When to reach for it
- Previewing a SigmaHQ rule in your SIEM’s syntax before writing a PR
- Teaching someone how Sigma’s
detectionblock maps to real queries - Comparing how the same rule looks across Splunk, Elastic, and KQL
- Working on sensitive rules you do not want to paste into a web converter