Sigma Rules

There are three ways to add Sigma rules to Security Data Lake: you can add them manually, import them from public Git repositories like the Sigma HQ Git repository, or directly upload them from your local file system.

Security Data Lake provides a YAML editor which allows you to create custom rules directly within the Security Data Lake UI. To add Sigma rules manually:

The editor notifies you if required fields are missing (e.g. title) or if a field should be of a certain type (e.g. string) before you attempt to save and exit. If you attempt to use an unsupported search modifier or input an aggregation in the conditions field, you receive a notification that those inputs are not supported.

Review the supported Sigma rule modifiers and operators table for currently supported features, rule specifications, fields required by Security Data Lake that might not be required by the Sigma specifications, and unsupported conditions and modifiers.

When you create Sigma rules, note that an event definition is also created. This is because events need streams and search windows to know over what time window and how frequently to search in order to function properly. These options can be modified in the editor.

To import Sigma rules from a Git repository, you first need to add the source repository to Security Data Lake. In this example, we'll be importing from SigmaHQ's public GitHub repository.

If you already have Sigma rules stored locally or exported from another system, you can upload them directly into Security Data Lake.

From the Sigma Rules page, you can then enable the added Sigma rules by toggling the Enable button. You can also use the Bulk Actions feature to enable, disable, or delete Sigma rules.

After creating your Sigma rules, you can enhance your detection coverage by configuring Sigma Correlations to detect multi-stage or chained threat activities. The process for adding a Correlation follows the same steps as adding standard Sigma rules. You can create one manually, import it from a public Git repository, or upload it from your local file system. Once added, you'll need to define the correlation logic that determines how individual events are linked, based on timing, field relationships, or shared attributes.

title: Many failed logins
id: 0e95725d-7320-415d-80f7-004da920fc22
correlation:
    type: event_count
    rules:
        - failed-logon-attempt
    group-by:
        - user_name
    timespan: 5m
    condition:
        gte: 5
level: high
status: experimental

title: Successful Login After 5 Failed Attempts
id: 0e95725d-beef-415d-80f7-004da920fc22
correlation:
    type: temporal_ordered
    rules:
        - many-failed-logins
        - successful-login
    group-by:
        - user_name
    timespan: 1m

You can assign alerts for Sigma rules within the Sigma rules workflow. When you edit a Sigma rule, a Notifications field with a drop-down menu option appears. If you have existing alerts configured, they will appear in the Notifications field when creating or editing a Sigma rule.

Security Data Lake Illuminate contains a lookup table that converts the most common fields present in Sigma rules from SigmaHQ repository to GIM fields. This conversion allows many rules to work seamlessly within the Security Data Lake Illuminate processing system. If you want to customize this lookup table by adding or overriding translations, you can do so by following the instructions provided in the documentation.

Whenever a search query for Sigma rules is executed, the fields in the Sigma rule are translated using this lookup table. If the lookup table does not contain a value for a particular field, the field provided in the Sigma rule is used instead.

All imported and user-defined Sigma rules are displayed in a table on the Sigma Rules page. Each entry includes key metadata such as the rule’s description, operational status, and configuration parameters. The Enabled column contains a toggle switch that allows you to enable or disable each rule.

To manage your Sigma rules:

Each Sigma rule imported into Graylog can also be executed directly as a search. This action opens a search view using the logic from the rule. This functionality is helpful when reviewing real-time or historical matches based on the rule conditions and can also help both when writing new rules as well as understanding existing ones.

To modify an existing rule:

If you want to create a variant of an existing rule:

This capability is useful for adapting standard rules to specific environments. The new rule can be modified independently without affecting the original.

This functionality is useful for backups, offline review, transferring rules between environments, or sharing with teams.

Every Sigma rule is automatically associated with an event definition when created; however, you can edit event definitions by:

Use the check boxes on the left to select multiple rules, then apply bulk actions. The following functionality is available for bulk actions: enable, disable, add notification, download, and delete.

From the list of imported repositories located in the Sigma Repos tab, you can perform the following actions. These actions can be performed on a single repository by clicking the ellipsis to the right of a selected repository, then selecting the required action from the options listed below.

All added repositories are shown in the Sigma Rules GIT Repos page.