Sigma Rules

General Description

This section is designed for importing Sigma rules and automatically converting these rules into scheduled tasks in the Task Scheduler module.

The Sigma Rules page displays a list of rules available in the Search Anywhere Framework system.

To view a rule, click on its name.

Importing Rules

To import Sigma rules, click the Import button in the top right corner.

Select the required yaml file.

After this, the Sigma rule will appear in the list.

Automatic Conversion of Sigma Rule to Search Task

To create a new search task from a Sigma rule, click the Create Task button from the rule view window or the Create Task button in the actions menu in the rule list.

Next, a window will appear for configuring the rule conversion. You need to specify the source from which the search query will be built, as well as map the fields from the Sigma rule to the fields of the specified source.

After filling in the source and the field mappings, you can click the Preview Search Query button to check the correctness of the resulting sml query.

In this window, you can also select options for automatically creating an Incident Action in the search task and adding tags from the Sigma rule to the search task.

Click the Create Task button in the bottom right corner, and you will be taken to the search query creation page with pre-filled fields from the Sigma rule and the search query in sml syntax.

Fill in or edit the necessary fields and save the search task to complete the conversion.