Sigma Converter

Convert simple Sigma detection selections into starter KQL and SPL. Unsupported conditions are flagged instead of guessed.

SecurityEvent
| where EventID == 4625 and TargetAccount == "admin"

index=wineventlog EventCode=4625 Account_Name="admin"