Sigma & Native Queries
Author once in portable Sigma and let Talon translate it to every SIEM — or write native SPL, KQL, EQL or YARA-L directly.
Sigma — the default
Sigma is the canonical format: a portable, vendor-neutral rule you write once. The pySigma sidecar validates the YAML and compiles it to every connected target, so the same logic ships to each SIEM without a rewrite. Talon re-translates live as you edit and again when you save, storing the Sigma under queries.sigma and each translation beside it.
Prefer a SIEM-specific rendering for one target? Click Customize on that target's preview — your text replaces the translation for that SIEM only, and Sigma stays the source for the rest. Reset to Sigma drops the override.
Native queries
When you'd rather write in your SIEM's own language — or need a feature Sigma can't express — author a native detection instead: Splunk SPL, Sentinel KQL, Elastic EQL or Chronicle YARA-L. It's stored verbatim in that dialect's field (queries.splunk, queries.sentinel, queries.elastic or queries.yara_l) and runs exactly as written.
Translation
The pySigma sidecar renders a Sigma rule per target, applying a processing pipeline where one exists so the output uses real field and source names rather than bare Sigma fields:
When a rule can't be expressed in a SIEM's language, that target shows an error instead of a query while the others still translate. Library rules are converted in advance and re-converted only when the rule itself changes.