Sigma Rule Tester
Evaluate a Sigma rule against sample events and see which search identifiers matched. Rules using features it cannot evaluate are refused by name rather than silently returning no match.
Paste a rule and some events. Unsupported Sigma features are named rather than ignored, so a verdict is never guesswork.
What this implements
Search identifiers as maps (fields joined by AND), lists of maps (OR), and keyword lists matched
against the whole record. Values are case-insensitive with * and ? wildcards, and a backslash escapes them. A list of values is OR
unless |all is set. A null value
matches an absent or null field.
Conditions support and, or, not, parentheses, 1 of them, all of them, and N of prefix*.
Field lookup tries the exact key, then a dotted path, then a case-insensitive key. Real backends differ here, so confirm against your own pipeline before trusting a near miss.
Everything here runs in your browser. Nothing leaves this tab.