sigma

Placeholder Rules

The rules available in this folder, are flexible detection templates that can be customized for your environments or use cases. Examples include rules that would require a domain or workstation variation that is specific to the company environment. This would vary on a case-by-case basis.

As a result, placeholder rules serve as an abstract detection template, where you adjust the placeholder value to fit your use case.

Placeholder Transformations

Placeholders can be mapped to the following pySigma transformations:

• command_placeholders
• file_placeholders
• http_placeholders
• query_expression_placeholders
• value_placeholders
• wildcard_placeholders

As stated in the included documentation, this is to keep private rules clean and make any environment-specific information reusable to the community. You use one of the placeholder transformations above, and future users of the rule can simply adjust the value to their use case.

The full updated list, can always be found here.

References

• Sigma Blog Post
• Sigma Specification - Placeholders

This site is open source. Improve this page.