Thomas Patzke – Medium

Thomas Patzke

Pinned

Thomas Patzke
in
Sigma_HQ

Connecting Sigma Rule Sets to your Environment with Processing Pipelines

Logs differ and handling these differences is complex. pySigma processing pipelines provide a powerful solution for this problem.

Jun 6, 2023

Generation of the same Sigma rule into a Splunk query without a pipeline, only the Sysmon pipeline and in addition the custom pipeline developed in this article.

Jun 6, 2023

Thomas Patzke
in
Sigma_HQ

Introducing Sigma Correlations

One of the most requested features for Sigma in the last years was the ability to express correlation searches. Now it’s available!

Jun 11

A AI-generated picture of small boxes that appear like small devices interconnected with multiple cables between each other to illustrate event correlations.

Jun 11

Thomas Patzke
in
Sigma_HQ

Beyond One-Size-Fits-All: Sigma’s Approach to Taxonomies

Sigma Flexibility: Crafting Rules with Your Choice of Taxonomy

Nov 16, 2023

Beyond One-Size-Fits-All: Sigma’s Approach to Taxonomies

Nov 16, 2023

Thomas Patzke
in
Sigma_HQ

Introducing Query Post-Processing and Output Finalization to Processing Pipelines

Query post-processing and output finalization are two new stages in the Sigma rule conversion process that allow to define custom output.

Sep 3, 2023

The processing pipeline described in this article and the resulting output.

Sep 3, 2023

Thomas Patzke
in
Sigma_HQ

Building Flexible Detections with Sigma Placeholders

How placeholders allow to separate detection logic from environment-specific values to build flexible&reusable Sigma rules.

May 22, 2023

Building Flexible Detections with Sigma Placeholders

May 22, 2023

Thomas Patzke

Thomas Patzke

Passionate about information security. Incident response, threat hunting and threat intelligence. Co-inventor and one of the core maintainers of Sigma.

Following

Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams