Module 12: Sigma — Detection Engineering
Write universal detection rules. Make your SIEM smarter.
7 lessons · 6 labs
SigmaWazuh
Operation APT Breach
Write Sigma rules for the campaign's patterns — brute force, encoded PowerShell, suspicious services.
Path
- Lesson01
Why Detection Engineering Matters
From reacting to creating alerts
- Lab02Intermediate
Lab 12.1 — Read a Sigma Rule
5 rules. Explain and map ATT&CK.
- Lesson03
Sigma Rule Structure
Title, logsource, detection, tags
- Lab04Intermediate
Lab 12.2 — Brute Force Detection
Write 5+ failed logons in 5m rule.
- Lesson05
Writing Your First Detection
Brute force, suspicious process
- Lab06Advanced
Lab 12.3 — Suspicious PowerShell
Detect encoded PowerShell.
- Lesson07
Sigma → Wazuh/OpenSearch
Converting and deploying rules
- Lab08Advanced
Lab 12.4 — Threat Report → Detection
Write, convert, deploy, test.
- Lesson09
Tuning & False Positives
Filters, exclusions, real-world rules
- Lab10Advanced
Lab 12.5 — Tune a Noisy Rule
200/day → <5/day without misses.
- Lesson11
SigmaHQ: 3,000+ Rules
Navigating the repository
- Lab12Expert
Lab 12.6 — SigmaHQ Deployment
10 rules. Batch-convert. Deploy.
- Lesson13
Detection-as-Code: Engineering Your Defenses
Version-controlling detections with Git, CI/CD pipelines for automated rule testing and deployment, coverage metrics