Purple › Module 4 › Lesson 5
Quiz — Sigma
10 APPLY items on Sigma named, SIEM rules named, and rule lifecycle on $PURPLE_LAB.
Opening
Sigma and SIEM Rules — Module Quiz
Ten APPLY items. Name Sigma and SIEM concepts on YOUR $PURPLE_LAB — never unauthorized production deploys, live victim IOCs, or stranger-network rules. Original Cyberlium. Next: Unit Test Rules.
Knowledge Check
APPLY: Sigma logsource defines:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma detection uses selection blocks and condition logic.
True or False
Knowledge Check
APPLY: SIEM conversion includes:
Multiple choice
Knowledge Check
APPLY: Tutorial deploys rules to stranger SIEM without scope — you:
Multiple choice
Knowledge Check
APPLY: Rule lifecycle stages include:
Multiple choice
Knowledge Check
APPLY: Cyberlium NEVER allows:
Multiple choice
Knowledge Check
APPLY: Test stage primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma tags include ATT&CK technique IDs like attack.t1059.001.
True or False
Knowledge Check
APPLY: chmod 600 on Sigma notes means:
Multiple choice
Knowledge Check
APPLY: Next lesson after this quiz:
Multiple choice
Answer all 10 knowledge checks to continue. (0/10 answered)