All playbooks
Detection engineering · Engineers using Splunk, Sentinel, Elastic or Wazuh
Sigma translation validation
Review a supported SIEM preview against local mappings and test cases.
A translated artifact is a draft to inspect in the target's data model before it becomes an operational detection.
What this does not establish
- A preview does not show that the target accepted or executed it.
- Matching syntax does not establish correct source and field mappings.
- An unsupported Sigma construct cannot be silently approximated.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Keep the source rule and target explicit.
Record source rule version and target
- Keep the Sigma condition and selected backend with the output.
- Identify the intended event source in that environment.