The extension offers various snippets to streamline the sigma rule creation process:
reference (links will be auto-pasted)
The extension will perform some sanity checks on the sigma rule itself on the fly to make sure that it's confomring with the sigma standard and the SigmaHQ conventions and guidelines. A list of the currently implemented checks is availbale below
Title too Long
Description too Short
'contains' at wrong position in modifiers
Whitespace at end of Line
Single Item with All modifier
YAML not parsing
Various Tests from the official sigma repo
Quickfixes for some of the Diagnostics
Automatic continuation of lists
Lists will be automatically continued by pressing the enter key.
Use the CTRL (Command on Mac) modifier to create a new line regardless of the curent position of the cursor.
Use the Shift modifier to ignore this feature.
When there is an empty string, it gets deleted.
Hover for attack Tags
Adding new Tags per command
Click on the Sigconverter-Codelens in the first line convert your sigma rule with sigconverter.
You can define multiple sigconverter configs in the sigma.sigconverterConfigs setting. Here are some example configurations: