// TOOLS

Security Tools

⚒️ Sigma Forge

Everyone translates rules into the SIEM. This does the opposite: you start from the event in front of you and walk out with the rule written. Paste a real event, tick what defines the malicious behaviour, and take away the Sigma rule plus its query in five dialects. What does a Windows event log? Browse the Windows Event ID reference. Already have a rule? Run it through the detection linter.

1 · Raw log→ 2 · Fields→ 3 · Sigma rule→ 4 · KQL / SPL / Lucene / EQL / Wazuh
Samples:

Want to check whether your rule really catches without flooding you with false positives? Test it against a log stream in the Sigma Detection Lab.

Only the selected configuration is transferred within this tab, for up to 10 minutes. The log is not sent to the server. The bench uses synthetic samples and rejects unsupported conditions.

Frequently asked questions

What does Sigma Forge do?
It turns a real log into a Sigma detection rule and translates it to KQL, SPL, Lucene, EQL and Wazuh, ready to paste into your SIEM.
What is Sigma?
A generic, SIEM-agnostic detection-rule format: you write the rule once and translate it to each platform.
Is my log sent to a server?
No, the conversion happens in your browser.