convert_sigma_to_kql

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It usefully mentions ECS field mappings and support for modifiers, wildcards, and complex conditions, but does not state the output format, error behavior for invalid YAML, or effects of parameters like include_comments and timeframe.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences, each adding distinct value: the conversion target, the mapping approach, and supported features. No repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the core purpose well, but there is no output schema and no explicit statement of what the tool returns. It also does not describe how the configurable parameters affect the output, leaving moderate gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds context about ECS mappings and supported syntax, which hints at acceptable sigma_rule input, but it does not provide parameter-specific meaning beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the transformation: 'Convert Sigma detection rules to Kibana Query Language (KQL) for Elastic Stack (Kibana, Elasticsearch).' It uses a specific verb and resource, and the direction of conversion is unambiguous, distinguishing it from the sibling convert_yara_to_sigma.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied by the tool name and conversion direction, but the description does not explicitly state when to use this tool versus alternatives such as convert_yara_to_sigma, nor does it give any exclusions. An agent can infer usage, but guidance is not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.