# wrg-sigma-rules

> Use this tool when you need to create, validate, and convert Sigma detection rules for multiple security platforms, solving problems of compatibility and efficiency in threat detection. It takes Sigma rules as input and outputs converted rules for various backends, including Splunk, Elastic, and Wazuh. Use it to streamline your security operations and enhance threat detection capabilities across different systems and MITRE ATT\&CK tactic categories.

Canonical page: https://skillsregistry.net/skills/wrg-11-wrg-sigma-rules  
JSON: https://api.skillsregistry.net/v1/skills/wrg-11-wrg-sigma-rules

## Description

Sigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.

## Trust

- **Trust score (0–1):** 0.95
- **Verification tier:** verified
- **Last scanned:** 2026-09-28

## Facts

- **Version:** 1.0.0
- **Skill type:** atomic
- **Execution layer:** mcp-remote
- **Runtime environment:** api
- **Category:** other
- **Updated:** 2026-09-28

## Source

- **Source listing:** [Glama](https://glama.ai/mcp/servers/lhq3arcicj)
- **Repository:** <https://github.com/WRG-11/wrg-sigma-rules>

## Use it

Resolve this record through the SkillsRegistry MCP server (no auth, read-only):

```
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp
```

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_skill",
    "arguments": {
      "slug": "wrg-11-wrg-sigma-rules"
    }
  }
}
```

REST: `GET https://api.skillsregistry.net/v1/skills/wrg-11-wrg-sigma-rules` · pull for local use: `GET https://api.skillsregistry.net/v1/skills/wrg-11-wrg-sigma-rules/pull`

---
SkillsRegistry indexes agent skills from public registries and GitHub. Skills we have analysed are scanned with Circle-IR and scored on six dimensions; each listing states its scan coverage. More: https://skillsregistry.net/llms.txt