INTRODUCTION TO DETECTION ENGINEERING WITH SIGMA

Summary from the TLDR InfoSec newsletter

Sigma provides a backend-neutral detection signature language for logs that can be converted to a variety of different query languages such as Splunk SPL or Sentinel KQL. This post walks through a Sigma rule to explain the components and syntax. It then introduces some more advanced features such as pipelines to resolve mapping issues between rules and data sources and correlation rules to provide stateful detections.