Back to Portfolio

SIGMA Rule Generator

Create platform-independent detection rules following the Sigma 2.0 specification. Generate valid YAML output for use across SIEM systems.

⚠️ Validation Notice

This generator follows the latest Sigma 2.0 schema, but generated syntax may contain errors. Always validate and test your rules before deployment using official Sigma tools.

Mode:

Required Fields

A short, descriptive title for the rule (e.g., 'Suspicious Process Creation').
The type of event to detect (e.g., 'process_creation').
The platform generating the logs (e.g., 'windows', 'linux').
Specific service or application (e.g., 'sysmon', 'powershell').
Define the search criteria. All selections are OR'd by default in Simple mode.
rule.yml INCOMPLETE 
# Your SIGMA rule will appear here...

Query Converter BETA 

Select a platform and click Generate...

History

Local Storage

Sigma Generator Changelog

v2.1.5 (Enterprise Overhaul) LATEST
  • [Feature] Splunk SPL Compiler: Advanced engine to compile Splunk Search Processing Language (SPL) including EventCode indices, wildcard maps, and regex pipelines.
  • [Feature] Elastic Lucene Compiler: Compiles logic into standard Elastic Common Schema (ECS) process fields.
  • [Feature] Advanced Mappings Customizer: Fully editable Settings cog-panel letting analysts override default base tables, custom projection lists, and raw field mapping text blocks in real time.
  • [Feature] Real-Time SIEM Syntax Checker: Embedded parser highlighting unbalanced parentheses, odd quotes, KQL single `=` assignments, KQL operators in Splunk/Elastic, and Splunk index double-equals.
  • [Feature] Expert Telemetry Templates: Loads credential ProcDumps, server webshell commands, ransomware shadow copy deletes, and Run key persistent autoruns.
  • [Fix] Timeline Markdown Render: Replaced all unparsed raw `**` syntax markers with styled HTML elements.
v2.1.0 (Core Features) 2026-05-31
  • [Feature] Dynamic YAML Importer: Pasting standard Sigma YAML rules rebuilds form fields and selectors instantly.
  • [Feature] Full History Form restorer: Saves inputsState in LocalStorage, enabling true saved-rule edits directly.
  • [Feature] Condition logical query compiler: Ingests advanced boolean grouping filters (AND, OR, NOT) for KQL & FQL.
  • [Feature] MITRE ATT&CK Auto-Suggest: Connected tags input box to techniques datalist suggestions.
  • [Feature] Auto-MITRE reference URLs: Generates reference link arrays automatically when technique tags are selected.
  • [Feature] Query Converter Syntax Highlighting: Colors compiled KQL & FQL query elements.
  • [Feature] Live Sigma Schema Validator: Pulses status indicators based on required field validations.
  • [Feature] Download Compiled Query utility: Exports compiled queries straight as `.kql` or `.fql` files.
  • [Fix] Keystroke UUID Fix: Caches rule UUIDs to block continuous rotating values.
v2.0.0 (Premium Redesign) 2026-04-12
  • Complete visual overhaul with sleeker glassmorphic neon layouts and aurora background sweeps.
  • Integration of the Beta Query Converter (Defender and CrowdStrike conversions).
  • Added LocalStorage history cache and keyboard shortcuts.

Import Sigma Rule (YAML)

Paste your raw Sigma YAML rule below. Our custom compiler will parse, identify category schemas, modifiers, and rebuild the form fields dynamically.