WRG Sigma Rules MCP server

This is a helper for people who write detection rules for security monitoring. It lets your AI assistant turn a plain description of suspicious activity into a Sigma rule, check that rule for mistakes, and translate it into the query language your security platform uses. It is handy if you work in a security operations centre and spend time writing or reviewing rules.

What this MCP server does

You describe the activity you want to detect, for example a suspicious command run by a known threat actor. Your AI sends that description to this helper, which builds a Sigma rule scaffold in YAML, a plain text format used for detection rules. You can then ask the helper to validate the rule, and it checks the syntax plus common best-practice issues. Finally you can ask it to convert the rule into a query for Splunk, Elastic, Kibana or Wazuh, and the helper hands back the converted query along with any warnings about what the conversion could not express.

Click to zoom

What you can do with it

• Turn a plain description of suspicious activity into a Sigma rule draft
• Check a Sigma rule for syntax errors and common mistakes
• Convert a Sigma rule into a Splunk SPL query
• Convert a Sigma rule into an Elastic, Kibana or OpenSearch query
• Produce a Wazuh-targeted query with a warning that it reuses the Elasticsearch backend
• Look up the corpus coverage rollup by MITRE ATT&CK tactic and technique
• Read canonical detection pattern definitions from the corpus

Try asking your AI

• “Draft a Sigma rule for npm package installs that reach out to a known command and control domain”
• “Validate this Sigma rule and tell me what is wrong with it”
• “Convert this rule to Splunk SPL and to Elasticsearch Lucene”
• “Show me the ATT&CK coverage rollup from the corpus”

What it gives back to you

You get back text in the chat: a YAML rule draft, a validation report listing errors and warnings, or a converted query in the target language. Conversion results also include a note about correlation semantics, which tells you where the query stops meaning the same thing as the rule, for example a dropped time window. Coverage lookups return counts of rules per ATT&CK tactic and technique, with a fingerprint of the corpus bytes behind the count.

Before you start

Who it's for

Security analysts, detection engineers and SOC teams who write or review Sigma rules and want help drafting, checking and converting them.