ATOMIC & STATEFUL DETECTION RULES

Summary from the TLDR InfoSec newsletter

Atomic detection rules focus on a single anomalous event. Stateful detection rules focus on identifying a pattern of suspicious activity such as repeated failed logins from a single IP. This post introduces both topics and provides sample Sigma rules for each.