Documentation

Detection Rule Studio (DRS) is a browser-based, stateless toolkit for detection engineers that parses, validates, lints, and translates Sigma rules in real time.

Quick Start

Paste or upload your Sigma rule YAML in the editor on the left.
DRS automatically validates, lints, and translates the rule as you type.
Select the target SIEM platform tab to view the translated query.
Copy the query or export the rule in your preferred format (YAML, JSON, Markdown, or ZIP).

Supported Platforms

Platform	Query Language	Package
Splunk	SPL — Search Processing Language	@drs/translator-splunk
Microsoft Sentinel	KQL — Kusto Query Language	@drs/translator-sentinel
Elastic	EQL — Event Query Language	@drs/translator-elastic
Chronicle (YARA-L)	YARA-L 2.0	@drs/translator-chronicle

Architecture

DRS is a Turborepo monorepo. All business logic lives in framework-agnostic TypeScript packages; the Next.js web app is a thin UI shell on top.

Monorepo Structure

detection-rule-studio/
├── apps/
│   └── web/                     # Next.js 14 front-end (App Router)
│       ├── app/                 # Pages: /, /docs, /about
│       ├── components/          # React UI components
│       └── state/               # useReducer app state
│
└── packages/
    ├── core/                    # Parser · Validator · Linter · Pipeline · ExportEngine
    ├── translator-splunk/       # Sigma → Splunk SPL
    ├── translator-sentinel/     # Sigma → Microsoft Sentinel KQL
    ├── translator-elastic/      # Sigma → Elastic EQL
    ├── translator-chronicle/    # Sigma → Chronicle YARA-L
    └── sample-rules/            # Shared test fixtures

Data Flow — Rule Processing Pipeline

Every keystroke in the editor triggers the full pipeline in under a millisecond. Results are memoised with an LRU cache keyed on the raw YAML string.

Package Responsibilities

@drs/core

·YAML parser — js-yaml with Sigma schema
·Validator — 5 stages, V0xx error codes
·Linter — style/best-practice L0xx rules
·Pipeline — LRU-cached parse→validate→lint
·TranslatorRegistry — discovers all translators
·ExportEngine — YAML / JSON / Markdown / ZIP
·MITRE ATT&CK tag extractor

Translators

·Each translator is an independent package
·All implement the Translator interface
·Auto-registered via TranslatorRegistry
·splunk → SPL index/sourcetype searches
·sentinel → KQL with workspace context
·elastic → EQL with index pattern
·chronicle → YARA-L 2.0 rule blocks

Validation & Lint Codes

Code	Severity	Description
V010	error	Missing required field: title
V011	error	Missing required field: logsource
V012	error	Missing required field: detection
V013	error	Missing required field: condition
V020	error	Field type mismatch (string expected)
V030	warning	Unknown logsource category or product
V050	warning	Malformed MITRE ATT&CK tag
L001	info	Rule title should be title-case
L002	info	Description is recommended
L003	info	Author field is recommended
L004	info	Status field should be set
L005	info	Date field is recommended

Export Formats

YAML

Original Sigma rule with metadata annotations

JSON

Parsed rule object with all fields serialised

Markdown

Human-readable report with translations inline

ZIP

All three formats bundled in one archive

Privacy

Detection Rule Studio is fully client-side. No telemetry, no analytics, no server calls. Every operation — parsing, validation, linting, translation, and export — happens entirely inside your browser. Your detection rules never leave your machine.