Universal detection-rule translation — Sigma, KQL, Splunk SPL, Elastic Lucene & EQL, YARA, DLP regex, and Semgrep. 100% client-side.
This is a free, browser-based DFIR toolkit on pranithjain.qzz.io. No signup required — all processing runs locally in your browser.
Universal detection-rule translation - entirely in your browser. Any format converts to any other: Sigma, Microsoft KQL, Splunk SPL, Elastic Lucene & EQL, YARA, DLP regex, and a supply-chain Semgrep scaffold. Everything funnels through one intermediate representation.
Translate a detection between Sigma, KQL, SPL, EQL, YARA.
Heuristic, not pySigma - reverse-parsing query languages back into the IR recovers only flat `field op "value"` predicates. YARA / DLP / supply-chain carry no field semantics; every lossy step is flagged in the warnings panel.
Pick the source format (Sigma is the most-faithful) → pick a SIEM field-map preset (Defender / ECS / CIM) → paste a rule or load a starter → copy the emitted target.
8 starters · 3 field-map presets · multi-doc Sigma batch · IR inspector for debugging lossy parses.