Vendor-neutral detection engineering
Write the detection once.
Author in Sigma. Siemphony derives the metadata, links the ATT&CK techniques you tagged, and renders the rule for Microsoft Sentinel, Splunk, Elastic and Wazuh — with the reasoning for the logic sitting beside the editor rather than in a separate course.
Email and password, or a one-time link if you prefer. See what it does first.
Detection waveform
Playable — every point is a note
Sound is on — your browser starts it at your first click.
- ATT&CK techniques seeded
- 918ATT&CK techniques seeded
- expressible in Sigma
- 529expressible in Sigma
- published compositions
- 400published compositions
- micro-lesson topics
- 26micro-lesson topics
- translation backends
- 4translation backends
The published corpus sits under the system account @siemphony. It is machine-authored: an agent drafted a composition per technique and a second, adversarial pass reviewed every one — only what survived that review was published. It is a worked example to argue with, not an answer key.
125 of the 529 deliberately have no rule. Each is a parent whose only observable already belongs to a child, or a behaviour with no telemetry in any log source available to it — and each records the reason, so the next pass does not redo the analysis and reach the same conclusion.
Translation
One source. Four artifacts.
Sigma stays the source of truth. The structured metadata, the technique tags and every query are derived from it, so there is one thing to maintain rather than four that drift apart.
The signal path
One source · four artifacts
The translator is not pySigma. It handles the common Sigma constructs, labels every output a preview, and refuses a logsource it cannot model rather than stubbing one that looks right and matches nothing. Measured against the full 2,842-rule SigmaHQ ruleset: 99% produce at least one platform query and 67% produce all four — 80% across the Windows endpoint rules this engine targets. No output has ever been executed against a real backend. Read the query before you run it.
Every query is real output from a published rule, not a mock-up. Paste your own Sigma at /translate — no account — and watch all four render as you type.
Why this and not three tools
Three things other tools make you leave the editor for.
A converter converts. A course teaches. A portfolio site hosts. Siemphony puts all three on one screen, in the order you actually work.
The lesson is beside the rule
Pick a detection topic in the composer and its lesson opens next to the editor: what the behaviour is, the telemetry you need, a walkthrough of the logic, where it will be noisy, how to tune it, and where it sits on the DeBMM maturity ladder. The topic list is the lesson list — thirty of them, hand-written.
Four backends, one edit
Change a selection and all four translations move with it, using the same code that runs on save — so the preview is what gets stored. Sentinel, Splunk and Elastic give you a query to run. Wazuh gives you a manager rule to deploy, and the interface says which, rather than calling both a query.
A repertoire you can send
Publish a composition and choose whether it appears on your profile. That page is a plain link that opens without an account — which is the whole point, because the person you send it to is not going to make one. Your profile is private until you switch it on.
- Sentinel KQL
- Splunk SPL
- Elastic ES|QL
- Wazuh XML rule
Coverage
Know what you have not covered.
Tagging a composition edits its Sigma YAML, so the tags and the rule can never disagree. Your studio counts them against the real ATT&CK v19.2 technique totals per tactic, not against a subset that flatters the number.
Sigma-expressible techniques, by tactic
529 total
A technique often names several tactics and is counted under each. ATT&CK v19.2 also renamed them: there is no defense-evasion any more — it is stealth plus defense-impairment.
Verified in the Siemphony lab
37 of 400 corpus rules
The lab evaluates a composition against real attack telemetry — public captures of the technique it claims to detect — and against a benign baseline, and records both counts in rule_tests. A rule earns the badge only by firing on a capture of its own technique.
That is a high bar and most rules do not clear it: 37 of 400 corpus rules carry it today. The rest read unverified, and say so on their own page. The badge expires, and any edit to the Sigma source invalidates it immediately.
Honesty
A badge nobody has earned is not decoration.
The verification badge is meant to be the thing that separates this portfolio from a folder of YAML. Showing it before it means anything would spend the only credibility the product has.
So the unearned state is designed rather than hidden: a dashed border, no colour, and a sentence saying exactly what would have to happen for it to fill in. A badge expires after ninety days, and editing a rule clears it immediately — because a claim about a rule has to be a claim about that rule.
Feedback
Other engineers tell you whether it fires.
Every published composition takes likes, comments and a verdict from anyone signed in. You cannot vote on your own — a database trigger rejects it, not just the interface.
works
Deployed it, and it fired on the behaviour it claims to detect.
doesn't fire
Deployed it, and the telemetry was not there or the logic missed.
bug
The rule or one of its translations is wrong. Say which, in 300 characters.
Straight answers
What ships today, and what does not.
Both columns are here because a detection tool that overstates itself is the thing this one is trying not to be.
Working now
- Sigma authoring, with the metadata, the technique tags and all four queries re-derived as you type.
- Translation to Sentinel KQL, Splunk SPL, Elastic ES|QL and a deployable Wazuh manager rule.
- Downloads in the artifact each platform actually ingests — a Sentinel ARM template, a Splunk savedsearches.conf stanza, an Elastic detection-rule NDJSON. Every one arrives disabled, because a detection that turns up already firing is one nobody chose to run.
- Thirty micro-lesson topics, in a panel beside the editor.
- ATT&CK tagging against all 918 techniques, with coverage read back from the rules you wrote.
- A verification lab that runs a composition against public captures of the technique it claims to detect, and against a benign baseline. It writes both counts, and the badge is service-role-only so it cannot be forged.
- Paste a rule at /translate with no account at all — four queries, the techniques it claims, and a noise check, none of it leaving your browser.
- A public profile anyone can open without an account, and 400 published compositions to take apart first.
- Likes, comments and a verdict on every published composition — and you cannot vote on your own, because a database trigger rejects it rather than the interface hiding the button.
Not yet
- A lab run you can trigger. The lab exists and has awarded badges, but only as a batch this side runs against captures held here — you cannot point it at your own rule, or your own logs, on demand.
- A guarantee that a translated query runs. The translator is not pySigma, and its output has never been executed against a real SIEM. Read the query before you deploy it.
- Export of a whole repertoire at once. Each composition downloads on its own, in each platform's own format, but there is no push to a GitHub repository and no dossier as a PDF.
Less noise. More signal.
Create an account and start from a labelled Sigma skeleton — not a pre-written rule with your name on it. What ends up on your profile is work you actually did.