Special Challenge: How to use #sigma rules

[dscryber (David Sciuto)]

Open Community members, can you answer this challenge? Post your response here and on Twitter, please.

Kartone (@Kartone) Tweeted:
Hey @graylog2 could you please suggest a good documentation or tutorial on how to use #sigma rules? I’ve been struggling for many months. Thanks!

Kartone

[kartone]

Has nobody used sigma rules to improve detections with Graylog?

[gsmith]

Hello && Welcome

I personal have not used sigma rules yet but I have found these posts.

Graylog and Sigma rules

Hi! I collect raw logs from sysmon to the stream “sysmon-logs” like here https://www.graylog.org/post/back-to-basics-enhance-windows-security-with-sysmon-and-graylog Now I found the project Sigma (Generic Signature Format for SIEM Systems) Graylog has support (convert generic Sigma rules into Graylog search queries) What is the best way to load sigma rules for sysmon into the Graylog? Create for example new stream “sigma-alert”.

Detecting Threats with Graylog Pipelines - Part 3

Graylog Backend added

Sigma and Graylog

Hello, Context: Windows servers send logs to Graylog (Winlogbeat, Sysmon…) My boss want I use Sigma, but for yet, I don’t understand how to use it. I have read the documentation… So, I installed Python3 and do “pip3 install sigmatools” I downloaded “sigma-master”, so I have lot of yml files. But what are the manipulations to do on Graylog. Thank you.

Hope that helps