Detection Engineering
Sigma Rule Lifecycle: Hypothesis to Production
The Sigma rule lifecycle from hypothesis to production — status stages (experimental to stable), CI testing, tuning, versioning, and when to deprecate a rule.
#siem
3 articles
Detection Engineering
SQL Injection Detection: A Defensive Guide
How to detect SQL injection across web, app, and database telemetry — with Sigma, Suricata, and SPL rules, a CVE-2025-1094 case study, and tuning tips. Lab-only.
Detection Engineering
Writing Sigma Rules That Actually Fire (Not Just Compile)
A detection engineer's guide to Sigma rules that survive production — pinned logsources, behavioral logic, field-mapping pipelines, tuned false positives, and CI.