Platform Guides

Supported platforms

CraftedSignal supports deploying detection rules to multiple SIEMs from a single source of truth.

CraftedSignal includes a built-in Sigma compiler. Author rules in Sigma and auto-compile to any connected SIEM:

Sigma rule → Splunk SPL
           → Sentinel KQL
           → CrowdStrike IOA
           → Rapid7 LEQL

The compiler handles field mapping, log source resolution, and platform-specific syntax. Compilation diffs show exactly what each SIEM receives so reviewers approve with confidence.

Portability scores flag rules that use Sigma features unsupported on a target platform.

See Targets & Mappings for target setup, read-only targets, automatic sync, field mappings, log source mappings, and suggested overrides.

Splunk

Connect

Add a Splunk target in Settings > Targets:

What CraftedSignal manages

• Saved searches (correlation searches)
• Lookup tables referenced by rules
• Macros and field extractions

Query language

Rules targeting Splunk use SPL:

index=web sourcetype=access_combined
| where uri_path LIKE "%/uploads/%.php"
| stats count by src_ip, uri_path
| where count > 3

Microsoft Sentinel

Connect

Add a Sentinel target in Settings > Targets:

The app registration needs Microsoft Sentinel Contributor and Log Analytics Reader permissions.

Runtime test validation DCR

Sentinel runtime test validation uses one shared Log Analytics custom table. Do not create a stream or table per Sentinel source table.

Add a Data Collection Endpoint (DCE), then create one Data Collection Rule (DCR) with:

Use this DCR creation payload, replacing the location and workspace resource ID:

{
  "location": "<same-region-as-log-analytics-workspace>",
  "kind": "Direct",
  "properties": {
    "streamDeclarations": {
      "Custom-CraftedSignalTest": {
        "columns": [
          { "name": "TimeGenerated", "type": "dateTime" },
          { "name": "TestMarker", "type": "string" },
          { "name": "SourceTable", "type": "string" },
          { "name": "Event", "type": "dynamic" }
        ]
      }
    },
    "destinations": {
      "logAnalytics": [
        {
          "workspaceResourceId": "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.OperationalInsights/workspaces/<workspace-name>",
          "name": "sentinelWorkspace"
        }
      ]
    },
    "dataFlows": [
      {
        "streams": ["Custom-CraftedSignalTest"],
        "destinations": ["sentinelWorkspace"],
        "transformKql": "source",
        "outputStream": "Custom-CraftedSignalTest_CL"
      }
    ]
  }
}

Then set these fields on the Sentinel target:

The app registration also needs Monitoring Metrics Publisher on the DCR for ingestion and workspace query access, such as Log Analytics Reader, on the Log Analytics workspace.

When you save the Sentinel target, CraftedSignal validates the DCR by ingesting a canary row into Custom-CraftedSignalTest and querying CraftedSignalTest_CL for its TestMarker.

What CraftedSignal manages

• Analytics rules (scheduled and NRT)
• Hunting queries

Query language

Rules targeting Sentinel use KQL:

W3CIISLog
| where csUriStem has_any (".php", ".asp", ".jsp")
| where csUriStem contains "/uploads/"
| summarize count() by cIP, csUriStem
| where count_ > 3

CrowdStrike

Connect

Add a CrowdStrike target in Settings > Targets:

The API client needs Custom IOA and Host Group permissions.

What CraftedSignal manages

• Custom IOA rules
• IOA rule groups

Query language

Rules targeting CrowdStrike use Custom IOA rule groups, which are defined as pattern-based conditions rather than a query language. CraftedSignal maps rule logic to IOA patterns for deployment.

Rapid7 InsightIDR

Connect

Add a Rapid7 target in Settings > Targets:

Optionally specify a logset_id for explicit log set targeting.

What CraftedSignal manages

• Custom alerts
• Log search queries

Query language

Rules targeting Rapid7 use LEQL:

where(action = FAILED_LOGIN)
groupby(source_address)
calculate(count)
having(count > 10)

Multi-platform rules

Write a single rule in Sigma and auto-compile to every connected SIEM. Or write in your SIEM’s native language — the choice is per-rule. CraftedSignal shows compilation diffs so you know exactly what ships:

csctl diff -token YOUR_TOKEN

Portability scores indicate how well the rule translates. Scores below a threshold trigger a review flag.

Credential security

All SIEM credentials are:

• Encrypted at rest with AES-256 using per-company encryption keys derived from the master secret via HKDF-SHA256
• Rotatable without downtime
• Never logged or exposed in API responses