APT Intelligence -- CTI to SIEM

CTI Report to SIEM Rule Converter

Enter the key indicators and behavioural TTPs from a threat intelligence report. Get draft SIEM detection rules in Splunk SPL and Microsoft Sentinel KQL within minutes -- converting passive intelligence into active detection.

Network indicators

IP addresses (one per line)

Domains (one per line)

URLs (one per line)

File indicators

File hashes (MD5/SHA1/SHA256, one per line)

Malicious file names or paths (one per line)

Mutex names (one per line)

Behavioural TTPs

Process names to monitor (one per line)

Command line patterns (partial strings, one per line)

Registry keys to monitor (one per line)

User-Agent strings (one per line)

Rule metadata

Threat actor name (for rule labelling)

Target SIEM platforms

Splunk SPL Microsoft Sentinel KQL

Enter threat intelligence indicators and click Generate to produce SIEM detection rules.