Sigma Rules Convertor

[adem_netsys]

Hi guys,

As you know, we can import sigma rules to Siem, but in some cases the content does not fit and does not accept. How can we overcome this situation, is there a tool you use to convert?

For example: https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/lnx_auditd_file_or_folder_permission...

Error in the FortiSIEM:Failed to convert sigma rule to fsiem rule: Failed to converted:
There is no EventID or EventCode in Sigma rule.

[cdurkin_FTNT]

Today only Windows sigma rules are supported via the converter.

You can try 3rd party sites like https://uncoder.io/ but sometimes it is just easier to manually create the rule.

[adem_netsys]

So, how can i do it for the linux rules?

Thanks