Detection content
Describe suspicious log activity and file patterns in reusable detection content. Rules become useful when paired with the right telemetry and validation.
- Log detections. Sigma describes detection logic in a portable format for compatible backends.
- File patterns. YARA-X evaluates rules that identify selected patterns in files or data.
- Rule validation. Test detection content against representative input before relying on it.
- Contextual review. Treat a match as evidence to investigate, with its limitations recorded.
Compatible backends, suitable log fields or files, licensed rule content, and false-positive tuning. A rule match does not independently prove compromise.