Query using Sigma rules

An example playbook on how to query Sigma rules from within TIM and query a SIEM/EDR.

Pack

Sigma

Tasks

32

Inputs

• Query

Commands used

• cbd-alerts-search
• es-eql-search
• qradar-search-create
• sentinelone-create-query
• splunk-search
• xdr-xql-generic-query