Query using Sigma rules

An example playbook on how to query Sigma rules from within TIM and query a SIEM/EDR.

Sigma · 32 tasks · 1 input · 0 outputs

Inputs

  • Query —

Commands used

cbd-alerts-search es-eql-search qradar-search-create sentinelone-create-query splunk-search xdr-xql-generic-query

Flowchart

no yes no yes no yes no yes no yes no yes Start Start Convert Sigma to XQL query - SigmaConverttoQuery Convert Sigma to XQL query SigmaConverttoQuery Set rules to context - SearchIndicator Set rules to context SearchIndicator Send Query to XQL - xdr-xql-generic-query Send Query to XQL xdr-xql-generic-query Is XDR installed - IsIntegrationAvailable Is XDR installed IsIntegrationAvailable Is Splunk installed - IsIntegrationAvailable Is Splunk installed IsIntegrationAvailable RUN QUERIES RUN QUERIES Send Query to Splunk - splunk-search Send Query to Splunk splunk-search Splunk Splunk XDR XDR Convert Sigma to Splunk query - SigmaConverttoQuery Convert Sigma to Splunk q... SigmaConverttoQuery Elastic Elastic Convert Sigma to Elastic query - SigmaConverttoQuery Convert Sigma to Elastic ... SigmaConverttoQuery Is Elastic installed - IsIntegrationAvailable Is Elastic installed IsIntegrationAvailable Send Query to Elastic - es-eql-search Send Query to Elastic es-eql-search Sentinel One Sentinel One Convert Sigma to Sentinel One query - SigmaConverttoQuery Convert Sigma to Sentinel... SigmaConverttoQuery Is Sentinel One installed - IsIntegrationAvailable Is Sentinel One installed IsIntegrationAvailable Send Query to Sentinel One - sentinelone-create-query Send Query to Sentinel One sentinelone-create-query GetTime - GetTime GetTime GetTime Qradar Qradar Convert Sigma to Qradar query - SigmaConverttoQuery Convert Sigma to Qradar q... SigmaConverttoQuery Is Qradar installed - IsIntegrationAvailable Is Qradar installed IsIntegrationAvailable Send Query to Qradar - qradar-search-create Send Query to Qradar qradar-search-create Carbon Black Carbon Black Convert Sigma to Carbon Black query - SigmaConverttoQuery Convert Sigma to Carbon B... SigmaConverttoQuery Is Carbon Black installed - IsIntegrationAvailable Is Carbon Black installed IsIntegrationAvailable Send Query to Carbon Black - cbd-alerts-search Send Query to Carbon Black cbd-alerts-search Done Done Done Done Done Done Done Done