// Detection Engineering
Sigma Rule Builder
Visual rule editor · Real-time conversion to Splunk SPL, Elastic KQL, Microsoft Sentinel KQL · 8 templates
Templates:
🔐 Failed Logon
💻 PowerShell Execution
💉 Process Injection
🔌 Lateral Movement RDP
⏰ Scheduled Task
📡 DNS Tunneling
🗑 Shadow Copy Delete
🎭 LOLBin Execution
Rule Metadata
Title *
Description
Author
Date
Status
experimental
test
stable
deprecated
unsupported
False Positives
Severity Level
Info
Low
Medium
High
Critical
Log Source
Category
— any —
process_creation
network_connection
file_event
registry_event
dns_query
image_load
pipe_created
driver_load
ps_module
ps_script
webserver
Product
windows
linux
macos
aws
azure
gcp
okta
office365
— any —
Service
Detection
+ Add Selection Block
Condition
MITRE ATT&CK Tags
Add
⚡ Generate Rules
↺ Clear
Blocks:
0
Fields:
0
Level:
medium
Index:
wineventlog
Σ Sigma YAML
🔴 Splunk SPL
🟡 Elastic KQL
🔵 Sentinel KQL
Sigma YAML — Generic Detection Format
Copy
Splunk SPL — Search Processing Language
Copy
Elastic KQL — Kibana Query Language
Copy
Microsoft Sentinel KQL — Kusto Query Language
Copy