Wrote a Sigma compiler that emits KQL, sharing the 36 rules that come with it
Not a Sentinel-only tool, but the KQL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.
dist/sentinel/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.
[link] [comments]