Your files stay on your device

Sigma rule validator

Validate Sigma 2.0 rules against the spec schema and the semantics it cannot express, with line-numbered findings and ATT&CK tags.

Paste a rule or add files, then press Validate rules.

What this validator checks, and what it does not
It reads one rule per document against the Sigma 2.x specification and its JSON schema: required title, logsource, and detection, the status and level vocabularies, UUID and date shapes, tag formatting, and the condition grammar (1 of, any of, all of them, patterns, not, brackets). Beyond the schema it checks what the schema cannot express: modifier spelling against the v2.1.0 modifier list, value types per modifier, all on a single value, null inside a value list, and unused search identifiers. Aggregations and near comparisons from Sigma 1.x are reported as removed in 2.0 rather than passing silently. It is a hand-rolled check, not the official schema validator binary; unknown top-level keys pass because the spec allows custom fields. Regex flavor checks are advisory only, and ATT&CK naming comes from a vendored snapshot, so fresh techniques may be unnamed.OptionsValidate rules

More regex & cron tools

- JSON validator (/json/validator)
- Regex tester (/dev/regex-tester)
- Glob tester (/dev/glob-tester)
All regex & cron tools (/dev)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/dev/sigma-rule-validator
Markdown version: https://nutter.tools/dev/sigma-rule-validator.md
Plain-text version: https://nutter.tools/dev/sigma-rule-validator.txt
Agent index: https://nutter.tools/llms.txt