Does SIGMA allow for sequence #2160
-
|
Does SIGMA allow for the creation of detection rules that have a defined sequence? Kinda like how Elastic EQL allows for sequence detections? |
Beta Was this translation helpful? Give feedback.
Answered by
Neo23x0
Oct 18, 2021
Replies: 1 comment
-
|
The new converter that supports correlation rules can do that. However, it always depends on the respective backend if it supports such queries. |
Beta Was this translation helpful? Give feedback.
0 replies
Answer selected by
nasbench
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The new converter that supports correlation rules can do that.
https://twitter.com/cyb3rops/status/1338180505511063554?lang=en
However, it always depends on the respective backend if it supports such queries.