Sigma → Splunk pipeline

sigmac -t splunk -c splunk-windows -o rule.spl rule.yml

Converts a Sigma rule to Splunk SPL with environment configuration, deploying detection in the SIEM as code.

Use it in the detection-as-code flow when you want to bring Sigma rules to the SIEM: sigmac converts the YAML rule to SPL with environment configuration (splunk-windows: index and field mapping) and the result is deployed as a saved search or alert. It is the detection pipeline: the community rule (SigmaHQ) converted and deployed with CI/CD (041). In purple teaming and detection engineering, the Sigma→Splunk pipeline is the standard: the rule versioned in the repo, automated conversion, and deployment — detection as code.

Do not use it without the correct configuration: conversion without environment mapping (indices, fields) produces SPL that finds nothing — sigmac config is the quality of the deployment. SigmaHQ rules assume standard telemetry: environment-specific ones (EDR fields, custom indices) are adapted in conversion or in the rule. And note: classic sigma (sigmac) is for legacy environments — the modern ecosystem uses sigma-cli (pySigma) with maintained backends (this card covers both, choice depends on environment). The converted rule is validated against real data before alerting.