Sigma Language

As a SOC L2 analyst, you're past the point of just acknowledging alerts. You're expected to read detection logic critically, spot why a rule is firing, and propose changes to fix it. The problem is that each SOC can run a different SIEM, and each one speaks its own query dialect. If you've only ever read SPL, a KQL query feels foreign, even when it's expressing the exact same detection idea.

Sigma fixes this by giving the industry a common, vendor-agnostic format for detection rules. Write the logic once in Sigma, and you can convert it into whatever query language. This room is going to give you the ability to read, write, and tune detections in a portable language that travels with you, no matter where you work, using the Sigma language.

Learning Objectives

By the end of this room, you will be able to:

• Understand the role of Sigma rules in modern SOCs.
• Read Sigma rules and understand exactly what it detects.
• Write your own Sigma rule.
• Convert a Sigma rule into multiple SIEM query languages.
• Identify common Sigma syntax mistakes.

Prerequisites

• Intro to Detection Engineering room
• Detection Rules Development room
• Sysmon room or familiarity with basic Windows/Sysmon log fields (Image, CommandLine, ParentImage).