Lion Cipher Lab
Write your first Sigma detection rule
- SOC Analyst / Blue Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
In the brute-force lab you found an attack by hand, on one machine, with one set of commands. That does not scale and it does not travel: the moment you sit in front of a different tool — Splunk here, Elastic there, Microsoft Sentinel somewhere else — your grep pipeline is worthless, because every SIEM (Security Information and Event Management platform) speaks its own query language. Sigma solves exactly that. It is a vendor-neutral, plain-text format for writing a detection once and converting it into whichever query language your tools happen to use. Writing detections as Sigma is a core…
What you'll learn
- reading and writing Sigma rules
- YAML basics for detections
- logsource and detection/condition logic
- converting a rule with sigma-cli
- sharing detections in a portable format
Steps in this lab
- What Sigma is, and the problem it solves
- The anatomy of a rule
- How the detection and condition work
- Write a rule for the failed-login pattern
- Install the tooling — sigma-cli
- Convert the rule into a real SIEM query
- How SOCs share detections as Sigma
- Why writing detections beats running them