Attribution and third-party notices

HuntRule displays MITRE ATT&CK tactic and technique identifiers on rule pages, and maps them into the target platform's own ATT&CK representation when it converts a rule. The technique set is pinned to ATT&CK v15.1.

MITRE grants a non-exclusive, royalty-free licence to use ATT&CK for research, development and commercial purposes, on the condition that MITRE's copyright designation and that licence are reproduced in any copy. That designation, reproduced verbatim:

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. HuntRule is not affiliated with, endorsed by, or sponsored by The MITRE Corporation. The full terms are published at attack.mitre.org.

MITRE does not claim that ATT&CK enumerates every possible adversary behaviour. A rule in this catalog covering an ATT&CK technique is a statement about that rule, not a claim of defensive coverage of the technique.

These are two different things under two different sets of terms, and the difference decides what you may do with a rule you take from here.

The Sigma specification — the rule structure, detection semantics, condition grammar, modifiers and log-source taxonomy — is placed in the public domain by SigmaHQ, along with the Sigma logo. HuntRule implements that specification; it does not redistribute it.

Sigma rules are different. Rules from the SigmaHQ repository are released under the Detection Rule License (DRL) 1.1, which permits use, modification and redistribution but requires that a redistributed rule keeps the author identification it came with, a link to the rule or rule set where practicable, and an indication that it is under DRL together with the licence text or a link to it. Alerts your tooling raises from a DRL rule have to carry the author credit too.

Every rule in the catalog that did not originate here shows its licence and its author credit, and the database will not accept an imported rule that is missing either one.

A DRL-1.1 Sigma rule converted to SPL is still DRL-1.1, and still belongs to its author. Translating a rule into another query language produces a derived work of that rule, not a new work of ours. The licence and the credit travel with the query.

This is why every conversion result carries an attribution — on the failure path as well as the success path — and why the emitted query includes a credit comment naming the source rule, its author and its licence by default. Where a rule you paste in declares no author or no licence, the result says so explicitly rather than showing a blank, so an unknown licence stays visible as unknown instead of reading as none.

Keep those credit comments and licence notices intact when you copy a query out. The Terms of Service ask the same thing, and for third-party rules the rule's own licence requires it independently of anything we ask.

Converting a rule means translating Sigma field names into the field names of a target schema. Every mapping we ship was transcribed by hand from the vendor's own published documentation, and each one records the page it came from, the date that page was read, and who read it. A mapping the sources did not confirm is never rendered into a query.

Where the research established that a target schema genuinely has no equivalent for a Sigma field, that absence is recorded with the same provenance and surfaced as a gap, rather than being silently dropped or guessed at. Mappings that are close but not exact are labelled as approximate and carry a note explaining how they differ.

The documentation behind the current mappings was published by Microsoft, Splunk, Elastic, Google, Palo Alto Networks and the Open Cybersecurity Schema Framework. That documentation remains the property of its publisher: what we record is which page a factual claim came from, not a copy of the page.

The converter emits Splunk SPL and Microsoft Sentinel KQL. Both are publicly documented query languages, and our support for them was written from that public documentation.

Splunk and SPL are trademarks of Splunk LLC. Microsoft, Azure, Microsoft Sentinel, Microsoft Defender and Kusto Query Language are trademarks of Microsoft Corporation. Elastic and Elastic Common Schema are trademarks of Elasticsearch B.V. Google, Chronicle and Google SecOps are trademarks of Google LLC. Palo Alto Networks and Cortex are trademarks of Palo Alto Networks, Inc. IBM and QRadar are trademarks of International Business Machines Corporation. CrowdStrike is a trademark of CrowdStrike, Inc. SentinelOne is a trademark of SentinelOne, Inc. OCSF is a project of the Open Cybersecurity Schema Framework.

Product and company names are used for identification only. HuntRule is not affiliated with, endorsed by, or sponsored by any of these vendors, and none of them has reviewed or approved the queries this tool produces.

The conversion engine was written from public specifications and vendor documentation: the Sigma specification, the vendor query-language and schema references described above, and the published OCSF, ECS, ASIM and UDM schemas. No source code, mapping data, or mechanical transformation of either was taken from any existing Sigma conversion tool. Before the work began we evaluated one such tool, found its parser and tokenizer carried a non-commercial licence incompatible with a hosted service, and did not use it in any form.

This is a factual statement about how the code was produced. It is not a legal opinion.

If you are an author or rights holder and a credit here or on a rule page is wrong, missing, or you want it removed, tell us through the contact form and we will correct it. Our own terms are in the Terms of Service and the Privacy Policy.