Advanced tool
Detection Rule Builder.
Paste a detection idea. Enter generates Sigma-style logic, KQL, Splunk SPL, MITRE mapping, false positives, and tuning advice.
Detection ideaEnter runs
Enter runs the tool. Shift plus Enter adds a new line. Maximum 100,000 characters.
Detection packageSigma / KQL / SPL
No detection yet
Paste a detection idea or load an example.