SECURIX Developed Free Resource
SIEM Rule Builder
A free web tool that turns Sigma detection rules into ready-to-import Elastic Security rules, filtered by MITRE ATT&CK technique and matched to the data your SIEM collects.
Solution overview
The SIEM Rule Builder is a free web tool for finding Sigma detection rules and converting them into Elastic Security rules. Your team selects relevant content, adjusts the Sigma-to-ECS field mapping and exports rules for manual import into Kibana. This provides a starting point for validation and tuning against your own data.
Your business needs
Your detection priorities need practical rule content
Rule development
Writing every detection in ES|QL takes time when relevant community Sigma content already exists.
Field Mapping
Generic Sigma field names need to match the fields used in your Elastic environment.
A relevant selection of rules
Your team needs rules aligned with priority ATT&CK techniques and the telemetry available.
Who this is for
SOC and detection teams
Elastic Security teams developing detection content and consultants building initial SIEM rule sets.
SOC Engineers
Browse detection content by ATT&CK technique and tactic to support your monitoring priorities.
Detection Engineers
Convert Sigma rules to ES|QL with an editable, reusable field mapping.
Elastic SIEM consultant
Select and export initial detection content for customer-specific validation and tuning.
Our deliverables
Detection content prepared for Elastic Security
Browse, select and convert rules, then export them for manual import and validation.
- SigmaHQ rules — Browse and filter the included rule set by ATT&CK technique, tactic and metadata.
- ATT&CK Navigator layer — Upload a coverage layer to filter rules by the techniques from your assessment.
- Sigma to ECS field mapping — Edit field mappings, download them and import them again to reuse them in a customer environment.
- Your own Sigma rules — Upload individual rules or a ZIP archive and filter them as “custom rules”.
- YAML, JSON or ES|QL — View the rule details in the available formats.
- Sigma to ES|QL converter — Convert supported Sigma conditions and modifiers into ES|QL.
- Sigma YAML or Kibana detection rules — Download rules in the format you need. Kibana exports include the ATT&CK mapping.
- Editing rules in the interface
- Deploying straight into Kibana
- Rule testing
- Data ingestion and tuning against customer data
- SIEM targets other than Elastic
- Customer workspaces
The included content is a fixed snapshot of SigmaHQ release r2025-02-03 and ATT&CK 16.1. Exported rules may require adjustments before they work correctly with your data. The tool does not test detection effectiveness.
How it works
From Sigma rules to Elastic Security
-
Identify relevant ATT&CK techniques and available telemetry.
-
Browse Sigma content or upload a Navigator layer to narrow the selection.
-
Align Sigma fields with your Elastic Common Schema fields.
-
Convert supported rules to ES|QL and download Kibana detection rules.
-
Import into Kibana, check field compatibility and tune against your data.
Conversion capabilities
Sigma logic converted into ES|QL
Conditions
Support for and/or/not, nested conditions and “N of” patterns.
Modifiers
Support for contains, startswith, endswith, re, base64, cidr, exists and gt/lt.
Field Mapping
Editable Sigma-to-ECS mapping that can be saved and reused.
ATT&CK mapping
Tactics and techniques retained in exported Kibana detection rules.
Technology partners
Detection content for Elastic Security
The tool combines Sigma content with an ES|QL converter and Kibana detection-rule export.
Frequently asked questions
Before your check begins
Yes. Upload individual Sigma rules or a ZIP archive. Uploaded rules can be filtered as custom-rules and converted using your field mapping.
Yes. Upload its ATT&CK Navigator layer to filter rules to the techniques represented in your self-assessed coverage. This does not verify that the rules will work with your actual data.
Not always. Field mappings and rule logic may need adjustment. Import the rules into Kibana, validate them against your telemetry and tune them before relying on them operationally.
Contact
Let’s discuss your next step
Tell us about your detection priorities. Together, we’ll clarify the scope and how we can support your rule development.
