Purple › Module 4 › Lesson 4
Lab — Sigma
Pack Sigma named, SIEM rules named, and rule lifecycle cards — Sigma file from $PURPLE_LAB only.
Visual · t35_sigma_lab
Lab: Sigma pack. $PURPLE_LAB only. Original Cyberlium.
Opening
Sigma pack merges anatomy to conversion to lifecycle — paperwork before testing module.
Lessons 4-1–4-3 named Sigma anatomy, SIEM conversion, and rule lifecycle. This lab merges three sections into one $PURPLE_LAB Sigma artifact with M1 ethics and M3 DE cross-references. No stranger-network rules or live victim IOCs — Sigma literacy paperwork only. Next: Quiz — Sigma and SIEM Rules.
1. Lab contract: Sigma pack
Create $HOME/cyberlium-lab/t35-m04-l04-sigma-lab.txt merging Sigma named, SIEM rules named, and rule lifecycle sections with $PURPLE_LAB fictional T1059 rule and M1/M3 cross-references.
Optional: link lifecycle test stage to telemetry row from M3 pack.
Command guide
Try these commands — Lab contract: Sigma pack
Primary tools to practice this lesson: grep, curl. Reference sites: Sigma repo (https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security); MITRE T1110.001 (https://attack.mitre.org/techniques/T1110/001/); Elastic sigma (https://www.elastic.co/guide/en/security/current/rules-ui.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for live victim IOCs, stranger-network refs, production SIEM credentials — remove. Confirm all rules target $PURPLE_LAB fictional scenarios.
Sigma examples use placeholder paths — no real credentials.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Unit Test Rules.
Sigma literacy feeds detection testing lessons in M5.
4. What you ship: Sigma pack for $PURPLE_LAB
Merged Sigma, SIEM, lifecycle sections. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Sigma pack path. $PURPLE_LAB named. File t35-m04-l04-sigma-lab.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include live victim IOCs in Sigma rule. Skip lifecycle section.
Right
Write YOUR Sigma pack for $PURPLE_LAB. chmod 600. Next: Quiz — Sigma and SIEM Rules.
Mission: freeze YOUR Sigma pack on disk
1) Merge M4 literacy sections. 2) Confirm fictional rule examples only. 3) Link M1/M3 cross-refs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One governed Sigma pack beats ten untested SIEM console rules.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma pack should include rule lifecycle stages.
True or False
Knowledge Check
APPLY: Sigma pack supports:
Multiple choice