Sigma Tester
Build or paste a Sigma rule, and test it against sample events.
Build a Sigma rule and test it against sample events in the page. Sigma describes detection logic once, and converters turn it into each SIEM's own query language.
This runs in your browser. Nothing you type or open is uploaded.
How to read it
Write each selection as one field per line, Field|modifier: value. Fields in one selection are ANDed.
The condition combines selections by name: and, or, 1 of selection*, all of them.
Paste one event per line on the Test tab, as JSON or key=value. Each row says whether the rule matched and which selections did.
| Modifier | Syntax | What it does |
|---|---|---|
| equals | (bare field name) | Exact match, case-insensitive. |
| contains | |contains | Substring match, case-insensitive. |
| startswith | |startswith | Prefix match, case-insensitive. |
| endswith | |endswith | Suffix match, case-insensitive. |
| re | |re | JavaScript regular expression match against the field value. |
Sources
- Sigma Detection Format (sigmahq.io). The authoritative Sigma specification and documentation site, the reference to consult for full YAML syntax, field modifiers, and correlation-rule features beyond what this tool's built-in builder exposes.
Worth using too
- Uncoder IO (SOC Prime). A free browser-based IDE that translates Sigma rules into 12+ real SIEM/EDR/XDR query languages (Splunk, Elastic, Microsoft Sentinel, and more). Use it once a rule passes here to actually deploy it in a production platform.
- SigmaHQ Rule Repository. The official, peer-reviewed collection of thousands of community-maintained Sigma detection rules, a ready source of real-world rules to paste into this tester and validate against your own sample log events.
- Chainsaw (WithSecure Labs). A free, actively maintained command-line tool that runs Sigma rules directly against real Windows Event Log (EVTX) artifacts, a next step from this tool's sample-event testing when you need to hunt across an actual forensic dataset.