Detection-as-Code in One GitHub Action with RSigma

This page did not load. You can still read it on the original site — the toolbar below keeps your place in the directory.

Lint, validate, fields-drift, backtest, and ATT&CK coverage for Sigma rules in one workflow This is the seventh article in a series on RSigma . The first article introduced RSigma as a CLI tool for evaluating Sigma rules against JSON logs. The second covered running it as a streaming daemon with HTTP and NATS input, stateful correlation, and persistent state. The third showed how to convert Sigma…

Read on itnext.io ↗