Skip to main content

Convert Sigma Rules

  1. Download Sigma rules from https://github.com/SigmaHQ/sigma

  2. Copy the Convert-SigmaToDetectionRule.psm1 to the Windows VM

  3. Open a PowerShell ISE terminal and import the script as a module:

    Import-Module -Force Convert-SigmaToDetectionRule.psm1

  4. Run the script against the directory of Sigma YML rule files that you want to convert to Elastic Detection Rules:

    Convert-SIGMAToDetectionRule -Files $(Get-ChildItem <PATH_TO_SIGMA_RULES> -Recurse -Include *yml)

  5. The default filename for the output detection rules will be: detection_rules.ndjson