❌

Normal view

There are new articles available, click to refresh the page.
Before yesterdayMicrosoftSentinel

Wrote a Sigma compiler that emits KQL, sharing the 36 rules that come with it

Not a Sentinel-only tool, but the KQL backend may be useful here. It compiles Sigma into saved-search stanzas including the aggregation cases (stats dc(field) by ...), which is normally where hand-conversion falls over.

dist/sentinel/tyrian_detections.conf is pre-compiled in the repo if you just want to skim the searches. You will need to adjust the index= prefix.

github.com/zshguy/tyrian-detection-pack

submitted by /u/ParticularNote4390
[link] [comments]
❌
❌