Sigma → Kusto pipeline

sigmac -t kusto rule.yml

Converts a Sigma rule to Microsoft Sentinel KQL with sigmac, deploying the detection in Kusto as code.

Use it when the SIEM is Sentinel and you want to bring Sigma rules: sigmac with the kusto backend converts the YAML rule to KQL (the Sentinel query over normalized tables) and the result is deployed as an analytic rule or in hunting. It's the detection-as-code pipeline for Azure: the community rule converted to Sentinel's language. In purple teaming with Sentinel, the Sigma→Kusto pipeline standardizes the conversion: the repo rule, automated conversion, and CI/CD deployment.

Don't use it without the correct mapping: sigmac's kusto backend converts standard fields — the mapping to actual Sentinel tables (SecurityEvent, DeviceEvents) is reviewed in the conversion or in the rule; without it, the query won't find the fields. And note: sigmac's conversion to Kusto is the basic version — fine mapping (Sentinel table fields, KQL functions) is adjusted manually or with adapted rules. The converted rule is validated in hunting before alerting. For mass deployment of ATT&CK coverage, sentinel-attack (039) is the alternative with the pre-converted library.