Sigma converter

sigmac -t splunk -c splunk-windows rule.yml

Converts a generic Sigma rule to the target SIEM syntax (here Splunk), deploying community-maintainable detections.

Run it when you want to bring SigmaHQ detection rules (the open rule repository, maintained by the community and vendors) to your SIEM without rewriting them by hand: sigmac translates the YAML rule to SPL, KQL, Elastic query, or the format you need, applying your environment's configuration (-c with the config file that maps your indexes and fields). It's the way to deploy quality detections (kerberoasting, mimikatz, MITRE techniques) in hours instead of weeks, and keep them up to date with the repository. In a SOC with few detection engineers, Sigma is the multiplier.

Don't use it without reviewing the converted rule: SigmaHQ rules are generic and assume standard fields; your environment (index names, parsed fields, EDRs) requires adjustments, and a poorly adapted rule generates false positives or never fires. Mechanical conversion without validation is like copying a YARA from the internet without testing it. Also, don't convert rules you don't understand: deployment quality depends on knowing what the rule detects. And watch out for the version: Sigma 2.0 (pySigma) has changed the ecosystem — classic sigmac is for legacy environments; new projects use sigma-cli with modern backends.