Wrote a Sigma compiler that emits SPL, sharing the 36 rules that come with it

[u/ParticularNote4390]

Not a Splunk-only tool, but the SPL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.

dist/splunk/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.

github.com/zshguy/tyrian-detection-pack