Sigma to KQL Converter

Convert Sigma detection rules into ready-to-use KQL queries for Microsoft Defender and Microsoft 365 Defender hunting.

Client friendly – server-side conversion with strict limits Input size capped – no rules are stored

Rate limit: 5 conversions per 10 minutes per IP address. Large or complex rules may take a couple of seconds to process.

Sigma Rule (YAML)

Max ~50 KB per request • one rule at a time

Output platform

Output is optimized for your selected platform.

How this tool works

Your Sigma rule is sent securely to the InfinitSec back-end, where a dedicated converter process (based on PySigma backends) generates equivalent queries for Microsoft Defender (KQL) or Elastic (Lucene).

Input size and processing time are strictly limited.
No rules are stored or logged beyond basic error metrics.
Designed not to impact the main news platform performance.

Need help with Sigma or KQL content?

For custom detections, blue team consulting, or integrations, reach out at [email protected].