How to convert from Splunk to SIGMA?

[pritster5]

Via Sigma (rule format for SIEM's) converters, it is possible to convert Sigma rules to Splunk queries. 

This is a well established process and can be done through tools like: https://github.com/SigmaHQ/pySigma 
or https://github.com/SigmaHQ/sigma

My question is, is there any way to do the reverse?
Is there a way to convert Splunk queries into Sigma Rules?

[afroemmel_splun]

In case this is still a topic: https://www.patrick-bareiss.com/sigma2splunkalert-tutorial/

[PickleRick]

As with any such abstract tools, I'd advise strongly against using it.

I tested the sigmac some time ago and it produced an extremely ugly searches and didn't support a huge subset of the sigma rules specification.

I also doubt that fairly useful functionality the opposite way (splunk to sigma rules) is possible. Maybe for some small subset of spl commands and constructs but - as the infamous example of "spl for sql users" shows, automatic translation is simply producing bad results.

[Azeemering]

You are right....I normally use the Sigma searches as inspiration and use them to create and tailor a search for my own environment and specific needs. You need to look beyond the ugliness of the translation and find the detection gems in them.

[Azeemering]

I always user www.uncoder.io  but that does not work from Splunk to Sigma unfortunately.