Uncoder.io
Open source translator that converts Sigma and Roota rules into SIEM, EDR, and data lake query languages.
Technical Architecture & Overview
Uncoder.io, from SOC Prime, translates Sigma and Roota rules into multiple SIEM, EDR, XDR, and data lake languages, including Splunk SPL, Microsoft Sentinel KQL, and Elasticsearch Lucene, and packages IOCs into ready-to-run queries. The open source Uncoder IO is the self-hostable counterpart of the uncoder.io SaaS and its AI co-pilot version, Uncoder AI. The uncoder.io site now presents Uncoder as part of SOC Prime's Prime Architect, offered to enterprise teams. Uncoder IO can run on-premises without an internet connection for air-gapped networks.
Targeted Technical Use Cases
Porting detection rules between platforms without rewriting every query by hand.
Evaluation & Trade-offs
Core Strengths
- +Self-hosted Community Edition is free under LGPL-3.0.
- +Translation targets span SIEM, EDR, XDR, and data lake formats.
- +Functions that cannot be translated are flagged with a note in the output.
Trade-Offs & Limitations
- -Automated conversion still needs human review for semantics.
- -Ties into the SOC Prime ecosystem for advanced features.
Defensive Security Application
Detection-as-code portability across the SIEM and EDR platforms an organization runs.
Frequently Asked Questions
What is Uncoder.io?→
Uncoder.io, from SOC Prime, translates Sigma and Roota rules into multiple SIEM, EDR, XDR, and data lake languages, including Splunk SPL, Microsoft Sentinel KQL, and Elasticsearch Lucene, and packages IOCs into ready-to-run queries. The open source Uncoder IO is the self-hostable counterpart of the uncoder.io SaaS and its AI co-pilot version, Uncoder AI. The uncoder.io site now presents Uncoder as part of SOC Prime's Prime Architect, offered to enterprise teams. Uncoder IO can run on-premises without an internet connection for air-gapped networks.
What is Uncoder.io used for?→
Porting detection rules between platforms without rewriting every query by hand.
What are the strengths of Uncoder.io?→
- +Self-hosted Community Edition is free under LGPL-3.0.
- +Translation targets span SIEM, EDR, XDR, and data lake formats.
- +Functions that cannot be translated are flagged with a note in the output.
What are the limitations of Uncoder.io?→
- +Automated conversion still needs human review for semantics.
- +Ties into the SOC Prime ecosystem for advanced features.
How is Uncoder.io used defensively?→
Detection-as-code portability across the SIEM and EDR platforms an organization runs.