search

SigmaHQ / sigma-specification

Sigma rule specification
Other
111 stars 40 forks source link

Reference to other rules in the condition of a detection #7

Open thomaspatzke opened 2 years ago

thomaspatzke commented 2 years ago

Discussed in https://github.com/SigmaHQ/sigma-specification/discussions/6

Idea: add a correlation type that allows to inject/include detections from one rule to another and use them from there. This would be quite useful for false positive handling, generic rule parts and possibly other use cases typically encountered in integration of Sigma into an existing detection environment.

rjurney commented 1 year ago

This would form a graph - links between rules and the data types [and properties] within them - that would be useful for many reasons. This is something many companies working in cybersecurity are working on, it would make sense to pool resources.