Sigma
Detections › Import › Sigma. Paste one rule or upload a file with several. Each rule is compiled to a native query rule: the log source is mapped to XenXDR data sources, field names are mapped through the dictionary, modifiers (contains, startswith, endswith, re, all, wildcards) are translated, and N of selections are expanded.
Imported rules arrive disabled and are marked as imported, with the original Sigma text kept for reference. Review each one, run its preview, then enable it. The import reports any field it cannot map, so you can adjust the rule before enabling it.
KQL and EQL
A subset of both languages compiles to native rules. Supported constructs are listed in the import dialog; the import names any construct it cannot compile, so you always know exactly what compiled.
What compiles well
- Process, network, file and registry detections on Sysmon and Windows event fields.
- Authentication detections on Windows Security and Linux authentication events.
- Simple counts and thresholds.
Keeping in sync
Re-importing a rule with the same identifier updates the native copy and keeps your exceptions, playbook binding and enabled state. Local edits to an imported rule are preserved as an override and shown as such.