Preparing a Sigma rule

To convert a Sigma rule to a KUMA rule:

  1. Copy the correlation rule that you want to edit from KUMA to the rule tab of the converter. Select the settings in the drop-down lists as necessary. Fix any errors if necessary.
  2. In the Sigma converter, in the backend field, select kuma, in the Format field, select default, and leave the pipeline field empty.
  3. Go to pipeline.yaml tab and copy the "Example dictionary adapted for pySigma" there.

The rule is converted.

The result is a WHERE clause for an SQL query.

You can copy the end result to KUMA if it is a query or a filter. If you want to use a rule in KUMA, you can import rules into KUMA one by one.

Page top