Sigma Rules
Most recent version: v0.0.1
Last updated
Was this helpful?
Most recent version: v0.0.1
Last updated
Was this helpful?
Note that this Action is only available in certain Tenants. if you don't see it and want to access it.
The Sigma Rules Action detects whether an event matches one or several . By evaluating Sigma rules inline on raw events, threats can be detected as logs are created.
This Action allows you to explicitly map these rule fields to the corresponding fields in your log schema.
These are the input and output ports of this Action:
To open the configuration, click the Action in the canvas and select Configuration.
Click Add rule to start configuring the required Sigma rules.
You'll see a list of all the available Sigma rules. Choose the one that you need to match your events against.
Configure the required rule fields and click Add Rule.
You'll see the rule in the Action configuration window. Activate it by switching on the toggle button next to it. Click Add rule if you need to add any other rules.
Finally, give a name to the field that will contain the detected threats.
Click Save to complete.
In order to configure this Action, you must first link it to a Listener. Go to to learn how to link.
Find Sigma Rules in the Actions tab (under the Detection group) and drag it onto the canvas. Link it to the required and .
