Sigma rule converter
Paste a Sigma rule, choose your SIEM, and read the query — with the field map it used and everything it could not express.
A page per pair
Each of these is this tool with the target already chosen, plus what is worth knowing about that dialect before you trust a converted rule.
- SplunkSPLSearch Processing Language against a CIM-normalised index.Open schemaConvert
- Splunk — Raw IndexSPLSearch Processing Language against raw indexed events without assuming CIM normalisation.Open schemaConvert
- Microsoft SentinelKQLKusto over Sentinel's analytics tables.Open schemaConvert
- Microsoft Sentinel ASIMASIM KQLKusto over ASIM's unifying parsers, not raw tables.Closed schemaConvert
- Microsoft Defender XDRKQLKusto over the Defender advanced-hunting Device* schema.Closed schemaConvert
- Elastic SecurityKQLKibana Query Language over ECS-mapped indices — the Kibana default.Open schemaConvert
- Elastic SecurityLuceneLucene query_string — required when the rule uses a regular expression.Open schemaConvert
- Elastic SecurityES|QLES|QL pipeline query over ECS indices — case-insensitive by construction, unlike KQL and Lucene.Closed schemaConvert
- CrowdStrike FalconCQLCrowdStrike Query Language for Falcon LogScale and Next-Gen SIEM.Open schemaConvert
- SentinelOnePowerQueryPowerQuery (S1QL 2.0) for Event Search and Singularity Data Lake, on the native EDR schema.Closed schemaConvert
- Palo Alto Cortex XDRXQLXQL over the Cortex agent's xdr_data dataset, scoped by event type.Closed schemaConvert
Carbon Black CloudPlatform SearchLucene query for Carbon Black Cloud Processes Search (Windows process creation).Closed schemaConvert- Carbon Black EDRProcess SearchToken search over the on-premises EDR product, where the process columns hold file names rather than paths.Open schemaConvert
Google Security OperationsUDM SearchA UDM Search predicate list for Investigation > SIEM Search, scoped by the normalised event type. Not a YARA-L detection rule, which is a different artifact.Closed schemaConvert- IBM QRadarAQLAriel Query Language for on-prem QRadar SIEM (Windows process creation).Closed schemaConvert
- Sumo Logic Cloud SIEMRules expressionThe expression half of a Cloud SIEM rule, over the normalised schema.Closed schemaConvert
- Rapid7Rapid7 InsightIDRLEQLLog Entry Query Language, with case-insensitive operators throughout.Closed schemaConvert
- GraylogSearchGraylog search syntax, with regexes where wildcards are blocked.Open schemaConvert
- OpenSearchLuceneLucene query_string over an ECS-mapped index. Covers Amazon OpenSearch Service.Open schemaConvert
- OpenSearch PPLPPLPiped Processing Language over an ECS-mapped index. Covers Amazon OpenSearch Service.Open schemaConvert
- GrafanaGrafana LokiLogQLLogQL over a stream selector you supply. Loki indexes labels, not line contents, so the selector is yours to fill in.Open schemaConvert
- SQLiteSQLA SELECT over your own table. No regex: SQLite defines none by default.Open schemaConvert
- DFIRZircoliteSQLiteSQL against Zircolite's flattened logs table, with regex support.Open schemaConvert
How it works
- Step 1
Paste the rule
Drop a Sigma rule into the left pane, or open a .yml file. The tool says what it thinks you pasted before anything is sent.
- Step 2
Pick your SIEM
Choose the target dialect. Every shipped target is free and none of them are behind a sign-up.
- Step 3
Read the report
The query comes back with the log-source profile that was used, every field it renamed, and anything the target could not express.
- Step 4
Verify, then deploy
Run it against your own telemetry in audit mode before it alerts on anything.
Questions
Paste the rule into the left pane, pick your SIEM, and press Convert. The query appears on the right along with the log-source profile that was used, every field it renamed, and anything it could not express. No account and no sign-up.
Yes. Every shipped target is free with no sign-up and no daily cap. The converter is rate-limited against scripted abuse, not against people.
Today: Splunk (SPL), Splunk — Raw Index (SPL), Microsoft Sentinel (KQL), Microsoft Sentinel ASIM (ASIM KQL), Microsoft Defender XDR (KQL), Elastic Security (KQL), Elastic Security (Lucene), Elastic Security (ES|QL), CrowdStrike Falcon (CQL), SentinelOne (PowerQuery), Palo Alto Cortex XDR (XQL), Carbon Black Cloud (Platform Search), Carbon Black EDR (Process Search), Google Security Operations (UDM Search), IBM QRadar (AQL), Sumo Logic Cloud SIEM (Rules expression), Rapid7 InsightIDR (LEQL), Graylog (Search), OpenSearch (Lucene), OpenSearch PPL (PPL), Grafana Loki (LogQL), SQLite (SQL), Zircolite (SQLite). A dialect appears here only once the engine emits it — nothing is listed as a stub.
Treat it as a starting point. The report shows how much of the rule survived and what was dropped, but no converter knows your field names, your retention or your noise. Run it in audit mode against your own telemetry before it pages anyone.
No. An anonymous conversion is not written to any database. The rule is converted in the request and nothing about it is retained.
No. This runs one way, Sigma to your SIEM. If you paste SPL or KQL the tool will recognise it and say so rather than fail quietly.
Looking for rules rather than a converter? Browse the detection catalog — every rule is written in Sigma, so it converts here.