Sigma Rule Tester
Run a Sigma rule against JSON logs, see which events it catches and why, score it against labelled attacks and benign look-alikes, and export each hit as a structured alert. Or run every SigmaHQ rule for your log source at once.
Logs and rules stay in this tab. Only SigmaHQ rule files are downloaded, from jsDelivr or GitHub.
How the tester works
The page parses the rule with a YAML parser, compiles each search identifier into matchers, inlines them into the condition and evaluates every event. Matching follows the Sigma specification: case-insensitive unless the rule says |cased, wildcards * and ?, backslash escapes, and arrays in the log fan out so any element can match.
- Lint before you ship. Errors stop the rule: unknown or misspelled modifiers (the |contain and |regex that AI drafts invent), undefined identifiers, filters swallowed by 1 of them, regexes that do not compile. Warnings cover metadata, ATT&CK tags, unused selections and field names that do not exist in the CloudTrail, Okta, GitHub or Windows process creation schema.
- Score it. Events labelled
"_expect": "match"or"nomatch"become test cases, so a rule change shows its effect on caught attacks and false positives at once. The samples are labelled this way. - Structured alerts. Each hit exports as JSON with the rule, ATT&CK techniques, extracted entities (user, IP, host, process, account), the identifiers that matched and the evidence fields. That shape is what an automated investigation pipeline or a SOAR playbook reads.
- SigmaHQ pack. The page recognises CloudTrail, Okta, GitHub audit, Entra ID, Google Cloud audit and Windows process creation logs, downloads every SigmaHQ rule for that source and runs them all. Attack events that no rule catches are your coverage gaps.
Sigma tester FAQ
Are my logs or rules uploaded?
No. The Sigma engine runs in this page. The only network calls fetch SigmaHQ rules from jsDelivr or GitHub when you search for one or run the pack.
How do I score precision on my own logs?
Add "_expect": "match" to events the rule should catch and "_expect": "nomatch" to benign look-alikes. The page then counts caught attacks, misses and false positives. The engine ignores the _expect key when matching.
Which Sigma features are supported?
The Sigma 2.0 detection format: field maps and lists, keyword lists, wildcards and escapes, null and empty values, the modifiers contains, startswith, endswith, all, re with i, m and s, cased, exists, cidr, gt, gte, lt, lte, fieldref, windash, base64, base64offset and the utf16 encodings, plus conditions with and, or, not, brackets, 1 of, all of and them. Correlation rules and the deprecated count() pipe are reported as unsupported.
Why does my rule match nothing?
Open an event row. It lists each search identifier as true or false and the fields the rule reads that the event lacks. The usual causes are a field name that differs from the raw log, a value that needs a contains modifier, or a filter that is included by 1 of them.
What does the SigmaHQ pack run do?
It recognises the log source, downloads every SigmaHQ rule for it and runs them all against your events. You see which community rules fire, on which events, and which labelled attack events no rule catches.
Sample logs on this page are made up and use documentation IP ranges. SigmaHQ rules are fetched live from github.com/SigmaHQ/sigma under the Detection Rule License 1.1. Engine checked against 415 SigmaHQ cloud, identity, GitHub and Windows rules, October 2026.