SOC › Module 5 › Lesson 2
Sigma Named
Sigma literacy names the vendor-neutral detection format — read rule structure on YOUR $SOC_LAB mapped YAML snippet without claiming production coverage.
Visual · t29_sigma_named
Sigma literacy. $SOC_LAB only. Original Cyberlium.
Opening
Sigma writes once, convert to Splunk/Elastic — literacy names the standard, not unauthorized rule drops on live tenants.
Sigma is a generic signature format for detection rules: title, id, status, logsource, detection block with selection and condition, level, tags (MITRE technique references for context). Teams share Sigma for consistency — converters map to SPL, KQL, or other backends. Cyberlium reads Sigma structure on YOUR $SOC_LAB — compare a public Sigma brute-force example to YOUR lab field names conceptually; do not deploy to stranger SIEM. Next: Tuning Hygiene.
1. Sigma structure (named)
logsource: product, service (windows, security). detection: selection filters and condition (selection | count() > 5). fields: output field list. level: informational/low/medium/high/critical. tags: attack.t1110 for brute force — literacy context only.
On $SOC_LAB, map one Sigma selection field to a field in YOUR Windows auth sample.
Command guide
Try these commands — Sigma structure (named)
Primary tools to practice this lesson: grep, python3. Reference sites: Sigma rule fields (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic sigma convert (https://www.elastic.co/guide/en/security/current/rules-ui.html); MITRE mapping (https://attack.mitre.org/techniques/T1110/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why vendor-neutral rules help teams
Organizations migrate SIEMs — Sigma preserves detection intent. L1 who reads Sigma understands alert title and technique tag even if SPL backend differs.
Students compare Sigma github examples to lab JSON keys — adaptation literacy, not blind copy to production.
3. Literacy ≠ unreviewed rule imports
Forbidden: mass-import Sigma repo into employer tenant without tuning and change control. Allowed: Sigma literacy card — five YAML sections, one MITRE tag meaning, $SOC_LAB field mapping.
Ship: Sigma structure card for YOUR lab mapping. Next: Tuning Hygiene.
4. What you ship: Sigma structure card for $SOC_LAB
Five YAML sections and field mapping to lab sample. $SOC_LAB named. NO prod import. chmod 600.
5. What you record before the next lesson
Date. Sigma card. $SOC_LAB named. File t29-m05-l02-sigma-named.txt chmod 600.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import entire Sigma repo to production Friday night. Ignore logsource mismatch with your data.
Right
Write Sigma structure card mapped to YOUR $SOC_LAB fields. Next: Tuning Hygiene.
Mission: read Sigma structure on YOUR lab fields
1) Name five Sigma sections. 2) Explain one MITRE tag in plain language. 3) Map one selection field to lab JSON. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
logsource must match ingested data — Sigma for Windows Security fails on Linux-only index.
Knowledge Check
APPLY: Sigma is:
Multiple choice
Knowledge Check
APPLY: True or False: Sigma rules include logsource and detection blocks.
True or False
Knowledge Check
APPLY: Sigma literacy on Cyberlium avoids:
Multiple choice