Skip to main content

#detection-engineering

Every article tagged “detection-engineering”, newest first.

Articles tagged detection-engineering

A row of thin dark glass bars on a near-black background, with a few lit amber from inside and one glowing brightest

Tutorials

Sysmon Event IDs: All 30 Explained, and How to Turn Them On

All 30 Sysmon event IDs in v15.22: what each logs, its config tag, whether SwiftOnSecurity's config keeps it on, and the closest Security log event.

Nerea Guallar19 min read
Abstract rows of dark ridged slats curving across a black background, lit by a warm orange glow, evoking parallel paths fanning out from one source

Tutorials

Sigma Rules Explained: Read, Write, and Convert One

Sigma rules are vendor-agnostic YAML detections. Read one rule field by field, then see its real sigma-cli output in Splunk SPL and Microsoft Sentinel KQL.

Astrid Lindqvist16 min read