Sigma rule converter
Paste a Sigma rule, choose your SIEM, and read the query — with the field map it used and everything it could not express.
A page per pair
Each of these is this tool with the target already chosen, plus what is worth knowing about that dialect before you trust a converted rule.
- Sigma to SplunkSPLSearch Processing Language against a CIM-normalised index.
- Sigma to Microsoft SentinelKQLKusto over Sentinel's analytics tables.
- Sigma to Microsoft Defender XDRKQLKusto over the Defender advanced-hunting Device* schema.
- Sigma to Elastic SecurityKQLKibana Query Language over ECS-mapped indices — the Kibana default.
- Sigma to Elastic SecurityLuceneLucene query_string — required when the rule uses a regular expression.
- Sigma to CrowdStrike FalconCQLCrowdStrike Query Language for Falcon LogScale and Next-Gen SIEM.
How it works
- Step 1
Paste the rule
Drop a Sigma rule into the left pane, or open a .yml file. The tool says what it thinks you pasted before anything is sent.
- Step 2
Pick your SIEM
Choose the target dialect. Every shipped target is free and none of them are behind a sign-up.
- Step 3
Read the report
The query comes back with the log-source profile that was used, every field it renamed, and anything the target could not express.
- Step 4
Verify, then deploy
Run it against your own telemetry in audit mode before it alerts on anything.
Questions
Paste the rule into the left pane, pick your SIEM, and press Convert. The query appears on the right along with the log-source profile that was used, every field it renamed, and anything it could not express. No account and no sign-up.
Yes. Every shipped target is free with no sign-up and no daily cap. The converter is rate-limited against scripted abuse, not against people.
Today: Splunk (SPL), Microsoft Sentinel (KQL), Microsoft Defender XDR (KQL), Elastic Security (KQL), Elastic Security (Lucene), CrowdStrike Falcon (CQL). A dialect appears here only once the engine emits it — nothing is listed as a stub.
Treat it as a starting point. The report shows how much of the rule survived and what was dropped, but no converter knows your field names, your retention or your noise. Run it in audit mode against your own telemetry before it pages anyone.
No. An anonymous conversion is not written to any database. The rule is converted in the request and nothing about it is retained.
No. This runs one way, Sigma to your SIEM. If you paste SPL or KQL the tool will recognise it and say so rather than fail quietly.
Looking for rules rather than a converter? Browse the detection catalog — every rule is written in Sigma, so it converts here.