# Sigma Tester

Build or paste a Sigma rule, and test it against sample events.

Build a Sigma rule and test it against sample events in the page. Sigma describes detection logic once, and converters turn it into each SIEM's own query language.

## How to read it

Write each selection as one field per line, Field|modifier: value. Fields in one selection are ANDed.

The condition combines selections by name: and, or, 1 of selection*, all of them.

Paste one event per line on the Test tab, as JSON or key=value. Each row says whether the rule matched and which selections did.

## Related

- [YARA Tester](https://www.cyberkit.win/tools/yara-tester/)
- [Event ID Reference](https://www.cyberkit.win/reference/event-ids/)
- [Sigma Rules](https://www.cyberkit.win/drills/sigma/)

Canonical: https://www.cyberkit.win/tools/sigma-tester/

This runs in the browser. Nothing you enter is uploaded.