← detection engineer

Sigma Fundamentals — Rule Anatomy, Logsources, Conversion

intermediate 4h

Author, lint, test, and convert a Sigma rule for a real TTP. Learn the universal detection rule format used across 30+ SIEM platforms.

After this module you will

  • › Read and write every top-level Sigma rule field
  • › Configure logsource blocks for correct backend routing
  • › Combine selection blocks using condition expressions and modifiers
  • › Convert a Sigma rule to SPL and KQL using sigma-cli
  • › Explain what gets lost in translation across backends

Lessons

1 Anatomy of a Sigma Rule
15 min
2 Field Mapping and Log Sources
20 min
3 Selection Blocks, Condition Expressions, and Modifiers
25 min
4 Converting Sigma — sigma-cli, Uncoder, and What Gets Lost in Translation
25 min
5 Worked Example: Write a Sigma Rule for T1059.001 Encoded PowerShell
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →