SIEM Migration Guide — MyAdminDesk

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

One rule moves, the old one stays

A SIEM migration is a parallel run. The converters on this site turn a Sigma rule into a draft for Splunk SPL, Microsoft Sentinel KQL, Elastic, QRadar AQL, or Wazuh, and can draft a Splunk-to-KQL translation. A draft is not deployed because it converted. The detection guide is the test. The platform guides are the syntax.

You keep the old detection enabled until the new one has fired on a lab event and stayed quiet on a normal event. Then you disable the old one for that story only. A cutover of every rule on a Friday is how you go blind.

Logs must arrive at the new platform before any rule can be true. A rule with no events is not a successful migration.

You do not generate attacks to fill the new SIEM. The lab failure from the detection guide is enough.

One story, two platforms, one lab event

Pick the detection you already trust. Convert it. Read the draft. If the converter widened the match, narrow it back. Send the same lab event, or replay a log you already hold, to the new platform. See the new rule fire. See a normal event stay quiet.

Compare the two alerts. If the new one missed, the old rule stays, and the draft is the open item. If both fired, disable the old rule for this story and write the time.

Dashboards and retention are later. Detections that page humans move first.

The search language is the platform's. Do not assume SPL works in a product that uses KQL, AQL, or YARA-L. Confirm the version you run.

A change you can finish

The change is one story on the new platform, with the old rule disabled only after both results matched.

Rollback is re-enabling the old rule, which you do not delete this week.

Confirm the new platform is receiving the log.
Convert one rule and read the draft.
Narrow anything the converter widened.
Replay one lab event you are allowed to use.
Require a fire and a quiet result.
Only then disable the old rule for that story.
Keep the old rule's text until the next review.

Mistakes that outlive the command

a SIEM migration fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

Disabling the old SIEM on day one.
Deploying an unread conversion.
A widened match left in place.
Declaring success with zero events.
Generating a flood to test the pipe.
Deleting the old rule the same day.
Assuming every product speaks SPL.
Moving every rule in one window.

Decisions to write down before the window

One decision for a SIEM migration: Logs arrive before rules move. One story is the window. The draft was read and narrowed. Fire and quiet were both seen. The old rule stays until then, and is not deleted. The platform guide owns the language. The test event is a lab event. Rollback is re-enable. Retention and dashboards are later. And a second person compared the two alerts.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for a SIEM migration. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. a SIEM migration is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

Migration checks before the old rule is disabled

Confirm this before you call the change done: The new platform shows the log. The converted rule was read. The match is not wider than the old rule. A lab event fired it. A normal event did not. The old rule is still present. Disable happens only after the pair. You did not delete the old text. No generated attack was used. The language matches the product version. A second person saw both alerts. The next story is a later ticket. The hostname in the prompt matches the hostname in the ticket for a SIEM migration. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for a SIEM migration happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.