// tool reference · Monitoring & Detection
Sigma Detection Rule Builder Free
説明した挙動から、SIEM で使える Sigma 検知ルールを作成します。
Open Sigma Detection Rule Builder →
What it does
Builds a syntactically valid Sigma rule from a field, value and level — the deterministic companion to the AI Detection-Engineering Studio.
When to use it
- You know exactly what to match and just want correct Sigma syntax.
Inputs
Field names are the actual form parameters, verified against source.
| Field | 種類 | Required | Notes |
|---|---|---|---|
| title | text | required | Rule title. |
| field | text | required | Log field to match. |
| value | text | required | Value to match. |
| level | select | 任意 | Severity level. |
What you get back
A valid Sigma rule in YAML.
活用例
Input
title = Suspicious Shadow Copy Deletion field = CommandLine value = vssadmin delete shadows level = high
Output (abridged)
title: Suspicious Shadow Copy Deletion
id: 8f2e1a44-3c9d-4b7e-9a1f-2d6c8b0e4a11
status: experimental
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: 'vssadmin delete shadows'
condition: selection
falsepositives:
- Legitimate backup software pruning shadow copies
level: high
NOTE: 'contains', not 'equals'. Real command lines carry flags
('/all /quiet'), so an equality match would never fire. That single
choice is the difference between a rule that works and one that does not.
Validate against your backup tooling before enabling -- that is the one
false positive you will actually see.
How it works
Deterministic generation to the Sigma schema. Offline.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does なし do
It generates syntax; it does not tune. Every rule needs validation against your own baseline before enforcement -- an untuned rule is an alert-fatigue generator.
プライバシー
Nothing is stored.
Standards
Sigma