📜 Sigma Rule Builder

How to use

1. Fill in a title and a log source (e.g. category process_creation, product windows).
2. Add one or more selections. In each, pick a field (e.g. Image), a modifier (e.g. endswith) and one value per line.
3. Write a condition that references your selection names, e.g. selection_img and selection_cmd and not filter_sccm. Use Suggest from selections for a starting point.
4. Read the validation line, copy the YAML, and check the SIEM export tabs.

What the SIEM export does — and does not — do

The export is a best-effort translation, not pySigma. It faithfully transpiles the string operators (equals, contains, startswith, endswith), their list semantics (OR, or AND with all values), numeric comparisons, exists, and the full condition logic (and/or/not, parentheses, N of/all of them). Field names are passed through verbatim — map them to your schema (CIM, ECS, etc.) yourself. Modifiers with no faithful inline equivalent in a given backend (for example re on Splunk/QRadar, cidr on Splunk, base64, base64offset, fieldref) are never silently approximated: the field is omitted and listed in the notes so you can translate it by hand. For production pipelines, generate backend queries with pySigma.

Worked example

Press Try an example for a realistic process_creation rule (a PowerShell download cradle) with two selections and a negated filter, matching the SigmaHQ rules repository style.

References

• SigmaHQ sigma-specification — the rule format, modifiers and condition grammar.
• SigmaHQ/sigma — the community rules repository.
• pySigma — the reference converter for production SIEM backends.