My team recently converted our entire detection library to #SIGMA and created a wiki around it!
We are an MSSP & platform agnostic, meaning we have a version of a rule for pretty much every SIEM & EDR platform there is, and...
🧵1/3
Img: @fr0gger_
We are an MSSP & platform agnostic, meaning we have a version of a rule for pretty much every SIEM & EDR platform there is, and...
🧵1/3
Img: @fr0gger_
keeping all versions of rules in separate git repos was confusing to the SOC and made finding info about a detection hard.
Now we have a one repo in a single language, with a wiki containing rule info like goal, investigation tips, prebuilt queries, references, FPs, etc.
🧵2/3
Now we have a one repo in a single language, with a wiki containing rule info like goal, investigation tips, prebuilt queries, references, FPs, etc.
🧵2/3
We are still solutioning how we are going to track translation and deployment to each platform and client. @NotionHQ seems to be the frontrunner for that endeavor.
🧵3/3
🧵3/3
• • •
Missing some Tweet in this thread? You can try to
force a refresh
