Convert Sigma rules in your browser

Paste a Sigma rule below and convert it into a SIEM query without installing anything. The conversion runs entirely in your browser using pySigma compiled to WebAssembly via Pyodide, powered by the @northsh/pysigma-node package.

Large one-time download

The example below is a static code block until you click “Engage live editor”. Engaging downloads the pySigma engine (Pyodide / WebAssembly), which is a ~10 MB+ one-time download. Everything runs locally — your rules never leave your browser.

The block below shows a sample Sigma rule. Engage the editor to make it editable and convert it to a SIEM query of your choice — input on top, the generated query directly beneath.

title: Whoami Execution
status: test
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\whoami.exe'
  condition: selection
level: high

Image="*\\whoami.exe"

With a processing pipeline

Pipelines control how a rule is converted — mapping fields, adding index prefixes, and so on. Engage the editor below to edit both the pipeline and the rule in separate tabs; the converted query reflects both. See the Pipelines page for the full reference.

pipelines/splunk_example.yml

name: Example Splunk Pipeline
priority: 100
transformations:
  - id: set_index_and_source
    type: add_condition
    conditions:
      index: windows_logs
      source: WinEventLog:Security
  - id: map_commandline
    type: field_name_mapping
    mapping:
      CommandLine: Process_Command_Line

rules/proc_creation_win_example.yml

title: Suspicious Command
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    EventID: 4688
    CommandLine|contains: suspicious_command
  condition: selection

index="windows_logs" source="WinEventLog:Security" EventID=4688 Process_Command_Line="*suspicious_command*"

How it works

1. On demand only. Nothing is fetched until you press the button, so opening this page stays fast.
2. Pyodide bootstraps. The first load downloads the Pyodide runtime and the real upstream pySigma library, then installs the backend for your selected target via micropip.
3. Conversion runs in a Web Worker. Work is offloaded to a Web Worker so the page UI stays responsive. The first conversion for a given target takes a few seconds while its backend installs; subsequent conversions are fast.

Supported targets

A range of common targets ship out of the box, including Splunk, Elasticsearch (ES|QL / Lucene / EQL), Grafana Loki, Microsoft Kusto (KQL), Panther, Google SecOps, SentinelOne, SQLite, SurrealQL, QuickWit, CrowdStrike Logscale, DataDog, NetWitness, Carbon Black and uberAgent.

For programmatic conversion in Node.js, Bun, Deno or your own web app, see the @northsh/pysigma-node documentation. For the broader conversion ecosystem, see the Backends and Pipelines pages.