Universal detection-rule translation — entirely in your browser. Any format converts to any other: Sigma, Microsoft KQL, Splunk SPL, Elastic Lucene & EQL, YARA, DLP regex, and a supply-chain Semgrep scaffold. Everything funnels through one intermediate representation.
Heuristic, not pySigma. Field-map presets handle the canonical Sysmon → Defender / ECS / CIM rewrites. Parsing non-Sigma languages back to the IR recovers only flat field op "value" predicates; YARA/DLP/supply-chain carry no field semantics. Every lossy step is flagged below — validate before operational use.
What it's for
Translate a detection between Sigma, KQL, SPL, EQL, YARA.
What it isn't
Heuristic, not pySigma — reverse-parsing query languages back into the IR recovers only flat `field op "value"` predicates. YARA / DLP / supply-chain carry no field semantics; every lossy step is flagged in the warnings panel.
Typical workflow
Pick the source format (Sigma is the most-faithful) → pick a SIEM field-map preset (Defender / ECS / CIM) → paste a rule or load a starter → copy the emitted target.