Discussions

• 2 You must be logged in to vote

  🙏

  Is there any way to to detect rising of events count by 20% in 2 minutes according to previous 2 minutes interval?

  smi71 asked Oct 10, 2024 in Q&A · Unanswered

  

  

  2
• 1 You must be logged in to vote

  🙏

  Sample log file for net_connection_lnx_back_connect_shell_dev.yml

  arorabharat144 asked Sep 20, 2024 in Q&A · Closed · Answered

  

  

  1
• 0 You must be logged in to vote

  💬

  Infection detected in Sigma_all_rules.zip

  Maurice1stit started Sep 26, 2024 in General · Closed

  

  

  0
• 1 You must be logged in to vote

  💬

  Missing Detections due to PowerShell Script Block Logging Fragmentation

  L015H4CK started Apr 15, 2024 in General · Closed

  

  

  4
• 1 You must be logged in to vote

  💡

  Organisation of rules according to Mitre ATT&CK

  dan21san started Dec 12, 2023 in Ideas · Closed

  

  

  

  

  3
• 1 You must be logged in to vote

  🙏

  Support for monitoring VPC Flow Logs, S3 Access Logs, and AWS Config?

  samuelebstein asked Jun 3, 2024 in Q&A · Closed · Answered

  

  

  1
• 1 You must be logged in to vote

  💡

  Exabeam

  KevinGhi started Mar 27, 2024 in Ideas · Closed

  

  

  1
• 1 You must be logged in to vote

  🙌

  Sigma Rule Validator GitHub Action

  mostafa started Feb 15, 2024 in Show and tell · Closed

  

  

  3
• 1 You must be logged in to vote

  🙏

  which all fields Sigmarule supports?

  preet-pdf asked Jan 1, 2024 in Q&A · Closed · Answered

  

  

  1
• 1 You must be logged in to vote

  🙏

  Searching for time in the last 90 days

  hippyjm asked Nov 27, 2023 in Q&A · Closed · Answered

  

  

  6
• 1 You must be logged in to vote

  🙏

  Linux Authentication Failure - Playbook Help

  Mav1814 asked Nov 10, 2023 in Q&A · Closed · Answered

  

  

  1
• 3 You must be logged in to vote

  🙏

  PowerShell Classic (Windows PowerShell.evtx) related rules fields

  fukusuket asked Oct 26, 2023 in Q&A · Closed · Answered

  

  

  7
• 1 You must be logged in to vote

  🙏

  Custom Playbook

  Mav1814 asked Oct 17, 2023 in Q&A · Closed · Answered

  

  

  2
• 1 You must be logged in to vote

  🙏

  Question regarding proxy_cobalt_malformed_uas

  orionova asked Jun 14, 2022 in Q&A · Closed · Answered

  

  

  1
• 1 You must be logged in to vote

  💬

  New line linting in the YAMLLINT process

  joshnck started May 23, 2023 in General · Closed

  

  

  

  

  9
• 1 You must be logged in to vote

  🙏

  linux log formats

  yadheen asked Sep 13, 2023 in Q&A · Closed · Answered

  

  

  8
• 1 You must be logged in to vote

  🙏

  SigmaTools sigma2attack errors

  Psyhil89 asked Jul 5, 2023 in Q&A · Closed · Unanswered

  

  

  1
• 3 You must be logged in to vote

  🙏

  Using Process Name instead of Image

  lolbins asked Jan 19, 2022 in Q&A · Closed · Answered

  

  

  1
• 1 You must be logged in to vote

  🙏

  Detection of redirection (>) in windows process creation command lines

  L015H4CK asked Jun 1, 2023 in Q&A · Closed · Answered

  

  

  2
• 1 You must be logged in to vote

  🙏

  Auditbeat use and Problems

  robrankin asked Nov 25, 2021 in Q&A · Closed · Answered

  

  

  1
• 1 You must be logged in to vote

  💡

  Add new status "deprecated" for obsoletes rules

  frack113 started Oct 21, 2021 in Ideas · Closed

  

  

  

  

  7
• 2 You must be logged in to vote

  💬

  Linux CommandLine Use - Require Laurel / Sysmon / EDR

  Neo23x0 started Sep 26, 2021 in General · Closed

  

  

  

  

  9
• 1 You must be logged in to vote

  💬

  Null modified date in recent commit

  isstabb started Mar 30, 2022 in General · Closed

  

  

  1
• 1 You must be logged in to vote

  🙏

  Does all windows sigma rules requires Sysmon Logs..?

  Logeshrathinakumar asked Mar 15, 2023 in Q&A · Closed · Answered

  

  

  

  

  2
• 1 You must be logged in to vote

  🙏

  Examples of Correlations

  joshnck asked Mar 14, 2023 in Q&A · Closed · Answered

  

  

  3