Tomasz Wiśniewski

Building a Detection Rule in Sigma From Scratch

From raw log fields to a portable Sigma rule — with the pitfalls that make detections noisy in production.