Sigma Rule Converter
Convert Sigma YAML detection rules to ManySignal DSL, Splunk SPL, Elastic EQL, or Microsoft KQL. Instant, accurate, no signup.
- Supports Sigma v2 specification including all standard modifiers
- Converts to ManySignal DSL, SPL, EQL, and KQL
- Preserves aggregation conditions and timeframe syntax
- Flags modifiers requiring manual review post-conversion
Sigma rule input
title: Okta MFA Push Bombing
id: 8c2f1d3a-9b4e-4f7c-b6a2-3d5e8f1c9b2a
status: stable
description: Detects repeated MFA push notifications
sent to a user in a short window, consistent with
MFA fatigue / push bombing attacks.
author: ManySignal Detection Team
date: 2024/09/15
logsource:
product: okta
service: system
detection:
selection:
eventType: system.push.send_factor_verify_push
outcome.reason: 'User rejected'
condition: selection | count() by actor.alternateId > 5
timeframe: 10m
falsepositives:
- Legitimate user accidentally rejecting pushes
level: high
tags:
- attack.credential-access
- attack.t1621 ManySignal DSL output
detection "okta_mfa_push_bombing" {
title = "Okta MFA Push Bombing"
severity = "high"
mitre = ["T1621"]
description = "Detects MFA fatigue / push bombing patterns"
source "okta" {
event_type = "system.push.send_factor_verify_push"
outcome_reason = "User rejected"
}
aggregate {
group_by = ["actor.alternateId"]
count > 5
window = "10m"
}
triage_questions = [
"Did the user receive an unexpected MFA push?",
"Has the user reported device compromise?",
"Is there concurrent impossible travel for this identity?",
]
} How this tool works
Paste your Sigma rule YAML
Copy any Sigma-formatted rule from GitHub, your detection library, or a vendor's Sigma feed and paste it into the input box.
Select your target backend
Choose ManySignal DSL, Splunk SPL, Elastic EQL, or Microsoft KQL as your conversion target.
Copy the converted rule
The converter outputs the equivalent rule in your target format, with a note on any modifiers that required manual adjustment.
What to do with the result
Batch convert your rule library
Contact ManySignal to batch-convert your full Sigma rule library into the ManySignal detection platform in a single migration.
Validate the output
Paste the converted rule into the Detection Rule Tester to validate it against a sample event before deploying.
Version control your rules
Store converted rules in your detection-as-code repository alongside the original Sigma source for auditability.
Sigma rule converter: frequently asked questions
Which Sigma version does the converter support?
The converter supports Sigma rule specification v2, including all standard condition syntax (selection, filter, keywords, aggregation) and the updated logsource taxonomy. Legacy v1 rules are supported with a compatibility flag.
Are all Sigma modifiers supported?
Standard modifiers (contains, startswith, endswith, re, cidr, base64, base64offset, windash, utf16, wide, all) are fully supported. Some advanced modifiers (expand, exists) have ManySignal DSL equivalents that may differ in syntax — the converter adds a comment flagging these for review.
Does the converter handle aggregation conditions?
Yes. Count, sum, min, max, and avg aggregation conditions with group-by clauses are fully converted. Timeframe specifications map to ManySignal's sliding window syntax.
Can I convert Sigma rules for non-standard log sources?
The converter handles all official Sigma log source categories. For custom log sources not in the Sigma taxonomy, you will need to map field names manually after conversion. The converter flags unrecognised logsource entries.
Is the conversion lossless?
For rules using standard Sigma syntax, conversion is functionally equivalent — the resulting rule will detect the same events. Field name mapping follows ManySignal's OCSF-aligned schema. Use the Detection Rule Tester to validate the converted output.
Can I convert Splunk SPL or KQL rules back to Sigma?
The free tool converts Sigma to target formats. Reverse conversion (SPL/KQL to Sigma) is available in ManySignal's platform as part of the detection migration toolset. Contact us for a bulk migration assessment.
What is ManySignal DSL?
ManySignal DSL is a HCL-inspired detection language that adds structured fields for triage question sets, MITRE ATT&CK tagging, data source declarations, and severity tuning — metadata that Sigma rules do not carry natively. Converted rules include placeholder values for these fields that you can populate before deployment.
Where can I find Sigma rules to convert?
The official SigmaHQ GitHub repository (github.com/SigmaHQ/sigma) contains over 3,000 community rules. Vendor-specific Sigma feeds are published by Microsoft, Elastic, Splunk, and many MSSP providers. You can also write your own rules in Sigma format and convert them.
How long does conversion take?
Individual rule conversion is instant. Batch conversion of large rule sets (500+ rules) typically completes in under 2 minutes via the ManySignal platform API.
Migrate your detection library to ManySignal
Import your Sigma rules, Splunk queries, or KQL detections in bulk and have them running in ManySignal within a day. Book a migration session.