Sigma规则构建
原名：building-detection-rules-with-sigma
使用 Sigma 规则格式构建厂商无关的检测规则，适用于多种安全平台和日志源，实现跨环境威胁检测。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 2
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-22
- TRACE 评分
- 3.6 / 5
内容概览
Use this skill when: - SOC engineers need to create detection rules portable across multiple SIEM platforms - Threat intelligence reports describe TTPs requiring new detection coverage - Existing vendor-specific rules need standardization into a shareable format - The team adopts Sigma as a detection-as-code standard in CI/CD pipelines Do not use for real-time streaming detection (Sigma is for batch/scheduled searches) or when the target SIEM has native detection features that Sigma cannot express (e.g., Splunk RBA risk scoring). - Python 3.8+ with pySigma and appropriate backend (pySigma-backend-splunk, pySigma-backend-elasticsearch, pySigma-backend-microsoft365defender) - Sigma rule repository cloned: git clone https://github.com/SigmaHQ/sigma.git - MITRE ATT&CK framework knowledge for technique mapping - Understanding of target SIEM log source field mappings Start with a threat report…