pwnsycybersecurity + privacy community
Runs on your device

Detection Workbench

Paste a Sigma rule or JSON logs. Lint, SIEM queries, findings and a drafted rule appear as you type, and nothing leaves your browser.

Full tools

Sigma Rule TesterPer-event evidence, labelled scoring, SigmaHQ pack Sigma ConverterSPL, KQL, Lucene and SQL with field maps Detection CoverageATT&CK heatmap, ranked gaps, Navigator layer Identity Anomaly FinderBaselines, tuning, suppressions, NDJSON alerts Audit Log ExplainerOne CloudTrail, Okta, Workspace or Slack event, decoded Alert Budget and Detection QualityPrecision, time to detect, tune list Telemetry Contract BuilderRequired logs per system, OCSF and ATT&CK Detection Pipeline Lab13 detections, CI, precision and containment on a sample estate

Detection engineering FAQ

What is detection engineering?

Writing, testing and tuning the rules that turn logs into security alerts. Rules are kept in version control, tested against known attack and benign events before they ship, measured for false positives after, and mapped to MITRE ATT&CK so coverage gaps are visible.

Do these tools upload my logs?

No. All of them run in the browser. The Sigma tools download public SigmaHQ rule files from jsDelivr or GitHub when you ask for them, and nothing you paste leaves the tab.

Which log sources are covered?

The tester and converter accept any Sigma rule and any JSON logs, with samples and field checks for AWS CloudTrail, Okta, GitHub audit and Windows process creation. Coverage maps every SigmaHQ log source. The anomaly finder reads Okta System Log, Entra ID sign-ins and CloudTrail.

Can I use these with AI-written rules?

Yes, and the tester is built for it. Its linter catches the mistakes AI drafts make, such as invented modifiers, field names that do not exist in the log schema and filters that 1 of them turns into selections, and the labelled test events show whether the rule fires on the attack and stays quiet on the look-alike.

Sample logs are made up. SigmaHQ rules are used under the Detection Rule License 1.1 (snapshot 2026-10-06, live fetch for rule text). MITRE ATT&CK v19.2 is a trademark of The MITRE Corporation.

Copied