Graylog and Sigma rules

[Dfg]

Hi!
I collect raw logs from sysmon to the stream “sysmon-logs”
like here
https://www.graylog.org/post/back-to-basics-enhance-windows-security-with-sysmon-and-graylog

Now I found the project Sigma (Generic Signature Format for SIEM Systems)

Neo23x0/sigma

Graylog has support (convert generic Sigma rules into Graylog search queries)

Florian Roth (cyb3rops)

What is the best way to load sigma rules for sysmon into the Graylog?
Create for example new stream “sigma-alert”.

[jan (Jan Doberstein)]

Sigma rules generate a search query to be used in Graylog.

You would just use the created searches on your already given data and might save them as ‘saved searches’