Lesson 3.2: Sigma rules
A detection is a question asked of logs automatically, again and again. Sigma is an open, vendor-neutral format for writing such questions once and converting them for any SIEM (Splunk, Sentinel, Elastic and more), so the community can share detections the way it shares YARA rules for files. In the lab you read a Sigma rule for Office applications starting a shell, translate its detection logic into a jq query, run it against a week of Sysmon events from the whole company, and separate the two real attacks from the documented exception.
17 min
You will learn to
- Explain what Sigma is for
- Read a rule's logsource, detection and condition
- Translate selections into a query
- Run a detection across many hosts
- Handle documented false positives with narrow filters
Key terms
- Sigma
- An open, generic signature format for log events, converted into each SIEM's query language.
- logsource
- Which kind of log a rule needs (product, category, service).
- Selection and condition
- Named groups of field matches, combined by a Boolean condition.
- Modifier
- How a value is compared: |endswith, |contains, |startswith, |re, |all.
- Detection as code
- Keeping detection rules in version control, reviewed and tested like software.
← Storing and checking passwords · All lessons · How systems store passwords →