Your files stay on your device

# Sigma rule converter

Parse a Sigma YAML rule, validate its structure, and convert its detections and conditions into the query language of the chosen backend (Lucene, SPL, or KQL) through a field-mapping pipeline, listing every condition that cannot be translated instead of dropping it.

Paste a rule to convert it.

What this converter does, and what it does not
It compiles the common Sigma shapes: one-level selections, the standard value modifiers (contains, startswith, endswith, all, re, gt and friends, exists), the boolean condition language with 1 of and all of, and the keyword field. It is not pySigma. Encodings like base64 and wide, %placeholders%, correlated field lists, and mid-string wildcards on KQL are refused and listed rather than guessed at, and anything listed in the losses above was left out of the query. Aggregation conditions (count, sum) belong in a correlation rule, not a plain search, so the converter emits the filter part and says so. Regex dialects differ per backend, and the field maps are a starter set, not the full pipeline catalogue. Test every query against your own SIEM before you rely on it.Options

## More regex & cron tools

- [Regex tester](/dev/regex-tester)
- [Cron explainer](/dev/cron)
- [Base64](/encoding/base64)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/sigma-rule-converter
Markdown version: https://nutter.tools/dev/sigma-rule-converter.md
Plain-text version: https://nutter.tools/dev/sigma-rule-converter.txt
Agent index: https://nutter.tools/llms.txt