Skip to main content
adem_netsys
Explorer III
June 10, 2025
Question

Sigma Rules Convertor

  • June 10, 2025
  • 1 reply
  • 859 views

Hi guys,

 

As you know, we can import sigma rules to Siem, but in some cases the content does not fit and does not accept. How can we overcome this situation, is there a tool you use to convert?

 

For example: https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_file_or_folder_permissions.yml

 

Error in the FortiSIEM:Failed to convert sigma rule to fsiem rule: Failed to converted:
There is no EventID or EventCode in Sigma rule.

    1 reply

    cdurkin_FTNT
    Staff
    Staff
    June 10, 2025

    Today only Windows sigma rules are supported via the converter.

    You can try 3rd party sites like https://uncoder.io/ but sometimes it is just easier to manually create the rule.

    adem_netsys
    Explorer III
    June 11, 2025

    So, how can i do it for the linux rules?

     

    Thanks