Aql

Simulate the attack with Atomic Red Team, then re-run the rule’s own converted query over the attack window and ask it directly whether it matched. not_triggered is the honest answer.

Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.

IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.

Don’t assume what a SIEM’s REST API can do. Write a prober that asks the live instance, and let the answer shape the architecture.

Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.