SIGMA RULE BUILDER
Create a portable Sigma detection rule locally and adapt it to your SIEM or EDR pipeline.
Local processing
This tool processes your input in your browser.
[IN] Rule inputs
Optional UUIDv4
One per line
[OUT] Sigma YAML _
YAML
1title: Suspicious process execution2status: experimental3description: Generated locally; review and tune before deployment.4logsource:5 product: windows6 service: sysmon7detection:8 selection:9 Image:10 - powershell.exe11 - cmd.exe12 condition: selection13level: medium14 Validation
Valid
No local schema issues detected.
Related Tools
Investigation Workspace
Analyze and organize security indicators, logs, files, and timelines in one local workspace.
Interactive Playbook Builder
Design and execute structured security incident response workflows.
Email Security Analyzer
Inspect email headers locally for SPF, DKIM, DMARC and phishing indicators.
Active Directory Attack Path Analyzer
Review BloodHound-style relationships locally and prioritize Tier 0 exposure.