Query using Sigma rules
An example playbook on how to query Sigma rules from within TIM and query a SIEM/EDR.
Sigma · 32 tasks · 1 input · 0 outputs
Details
| ID | Query using Sigma rules |
|---|---|
| From Version | 6.10.0 |
| Tasks | 32 |
| Tags | Sigma SIEM |
README
An example playbook on how to query Sigma rules from within TIM and query a SIEM/EDR.
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
This playbook does not use any sub-playbooks.
Scripts
- IsIntegrationAvailable
- SigmaConverttoQuery
- SearchIndicator
- GetTime
Commands
- es-eql-search
- sentinelone-create-query
- xdr-xql-generic-query
- qradar-search-create
- cbd-alerts-search
- splunk-search
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| Query | type:”Sigma Rule” | Optional |
Playbook Outputs
There are no outputs for this playbook.
Playbook Image
Inputs
Query—
Commands used
cbd-alerts-search
es-eql-search
qradar-search-create
sentinelone-create-query
splunk-search
xdr-xql-generic-query
Flowchart
id: Query using Sigma rules version: -1 name: Query using Sigma rules description: An example playbook on how to query Sigma rules from within TIM and query a SIEM/EDR. tags: - Sigma - SIEM starttaskid: "0" tasks: "0": id: "0" taskid: 9a1385bb-b418-42b2-8d42-a83049d2ea93 type: start task: id: 9a1385bb-b418-42b2-8d42-a83049d2ea93 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "3" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1125, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "2": id: "2" taskid: bef77971-71c6-41e5-82e0-821d89393da8 type: regular task: id: bef77971-71c6-41e5-82e0-821d89393da8 version: -1 name: Convert Sigma to XQL query description: Allows converting a Sigma Rule indicator into a SIEM query. scriptName: SigmaConverttoQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "4" scriptarguments: SIEM: simple: XQL indicator: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sigmaruleraw iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "3": id: "3" taskid: b7cbbca2-e0ef-4732-8371-49b42edff2d1 type: regular task: id: b7cbbca2-e0ef-4732-8371-49b42edff2d1 version: -1 name: Set rules to context description: |- Searches Cortex XSOAR indicators. Search for Cortex XSOAR indicators and returns the ID, indicator_type, value, and score/verdict. You can add additional fields from the indicators using the add_field_to_context argument. scriptName: SearchIndicator type: regular iscommand: false brand: Builtin nexttasks: '#none#': - "20" scriptarguments: add_fields_to_context: simple: sigmaruleraw query: simple: ${inputs.Query} separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1125, "y": 195 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "4": id: "4" taskid: d982ab0c-07a9-4ecd-85a9-cc775b5c9367 type: regular task: id: d982ab0c-07a9-4ecd-85a9-cc775b5c9367 version: -1 name: Send Query to XQL description: |- Execute an XQL query and retrieve results of an executed XQL query API. The command will be executed every 10 seconds until results are retrieved or until a timeout error is raised. When more than 1000 results are retrieved, the command will return a compressed gzipped JSON format file, unless the argument 'parse_result_file_to_context' is set to true and then the results will be extracted to the context. script: '|||xdr-xql-generic-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: query: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: ERROR - - operator: isEqualString left: value: simple: Sigma.format iscontext: true right: value: simple: xql accessor: query query_name: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: 'ERROR:' accessor: name separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 1505 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "5": id: "5" taskid: 7bf4cc89-1a9e-41d5-8fb9-35d3bda95d3f type: condition task: id: 7bf4cc89-1a9e-41d5-8fb9-35d3bda95d3f version: -1 name: Is XDR installed description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "31" "yes": - "2" scriptarguments: brandname: simple: Cortex XDR - XQL Query Engine separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "6": id: "6" taskid: 97402617-43d5-406f-8c80-7ede155b3a53 type: condition task: id: 97402617-43d5-406f-8c80-7ede155b3a53 version: -1 name: Is Splunk installed description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "31" "yes": - "11" scriptarguments: brandname: simple: SplunkPy separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "7": id: "7" taskid: 7eac303c-c599-4fcd-85d6-067b3ee50361 type: title task: id: 7eac303c-c599-4fcd-85d6-067b3ee50361 version: -1 name: RUN QUERIES type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "10" - "9" - "12" - "16" - "21" - "25" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1125, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "8": id: "8" taskid: 51edbbc9-0d2b-4adc-8454-6ee6fccddc4f type: regular task: id: 51edbbc9-0d2b-4adc-8454-6ee6fccddc4f version: -1 name: Send Query to Splunk description: Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers. script: '|||splunk-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: query: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: ERROR - - operator: isEqualString left: value: simple: Sigma.format iscontext: true right: value: simple: splunk accessor: query separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1505 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "9": id: "9" taskid: 6dcbedb8-3bd5-4f02-850a-4f3f7a6363e8 type: title task: id: 6dcbedb8-3bd5-4f02-850a-4f3f7a6363e8 version: -1 name: Splunk type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "6" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "10": id: "10" taskid: 5463457b-b79f-4e0b-80d3-d3b2fd2c5c58 type: title task: id: 5463457b-b79f-4e0b-80d3-d3b2fd2c5c58 version: -1 name: XDR type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "5" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 50, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "11": id: "11" taskid: 18c3946f-fa28-4478-8a74-3bf627d7f137 type: regular task: id: 18c3946f-fa28-4478-8a74-3bf627d7f137 version: -1 name: Convert Sigma to Splunk query description: Allows converting a Sigma Rule indicator into a SIEM query. scriptName: SigmaConverttoQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "8" scriptarguments: SIEM: simple: Splunk indicator: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sigmaruleraw iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 480, "y": 1325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "12": id: "12" taskid: 639a3824-1814-4b3e-86db-28c066c46783 type: title task: id: 639a3824-1814-4b3e-86db-28c066c46783 version: -1 name: Elastic type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "14" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 910, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "13": id: "13" taskid: 9baeaaf9-d28a-4b81-8522-f4f029ba4187 type: regular task: id: 9baeaaf9-d28a-4b81-8522-f4f029ba4187 version: -1 name: Convert Sigma to Elastic query description: Allows converting a Sigma Rule indicator into a SIEM query. scriptName: SigmaConverttoQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "15" scriptarguments: SIEM: simple: Elastic indicator: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sigmaruleraw iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 910, "y": 1325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "14": id: "14" taskid: 063b8055-dfe0-4954-8dc9-c3654a3d630e type: condition task: id: 063b8055-dfe0-4954-8dc9-c3654a3d630e version: -1 name: Is Elastic installed description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "32" "yes": - "13" scriptarguments: brandname: simple: Elasticsearch v2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 910, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "15": id: "15" taskid: 3ae9e098-725d-4431-8e69-f8009c927c0a type: regular task: id: 3ae9e098-725d-4431-8e69-f8009c927c0a version: -1 name: Send Query to Elastic description: Search using EQL query. script: '|||es-eql-search' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: query: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: ERROR - - operator: isEqualString left: value: simple: Sigma.format iscontext: true right: value: simple: elastic accessor: query separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 910, "y": 1505 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "16": id: "16" taskid: 3d9c778d-405f-4b56-8844-4b0e1942dfaf type: title task: id: 3d9c778d-405f-4b56-8844-4b0e1942dfaf version: -1 name: Sentinel One type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "18" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1340, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "17": id: "17" taskid: ac997a21-dbde-4952-8ca8-fd1af5314bc6 type: regular task: id: ac997a21-dbde-4952-8ca8-fd1af5314bc6 version: -1 name: Convert Sigma to Sentinel One query description: Allows converting a Sigma Rule indicator into a SIEM query. scriptName: SigmaConverttoQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "19" scriptarguments: SIEM: simple: Sentinel_One indicator: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sigmaruleraw iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1340, "y": 1325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "18": id: "18" taskid: 7fc3d614-4d33-4419-8fea-b396dec2bed0 type: condition task: id: 7fc3d614-4d33-4419-8fea-b396dec2bed0 version: -1 name: Is Sentinel One installed description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "32" "yes": - "17" scriptarguments: brandname: simple: SentinelOne V2 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1340, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "19": id: "19" taskid: 7e93c394-a0bd-4999-8865-01b724472206 type: regular task: id: 7e93c394-a0bd-4999-8865-01b724472206 version: -1 name: Send Query to Sentinel One description: Runs a Deep Visibility query and returns the queryId. You can use the queryId for all other commands, such as the sentinelone-get-events command. script: '|||sentinelone-create-query' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: from_date: simple: ${TimeNow} query: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: ERROR - - operator: isEqualString left: value: simple: Sigma.format iscontext: true right: value: simple: sentinel_one accessor: query to_date: complex: root: ${TimeNow} transformers: - operator: ModifyDateTime args: variation: value: simple: 30 days ago separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1340, "y": 1505 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "20": id: "20" taskid: 45ca4004-ded6-483d-83d5-230f94586fbf type: regular task: id: 45ca4004-ded6-483d-83d5-230f94586fbf version: -1 name: GetTime description: | Retrieves the current date and time. scriptName: GetTime type: regular iscommand: false brand: "" nexttasks: '#none#': - "7" scriptarguments: dateFormat: simple: ISO separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1125, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "21": id: "21" taskid: 8b934482-c16d-41fb-8279-166c8dae2f94 type: title task: id: 8b934482-c16d-41fb-8279-166c8dae2f94 version: -1 name: Qradar type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "23" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1770, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "22": id: "22" taskid: 150f60e0-4710-44e5-88e0-56bcb0b6b4a8 type: regular task: id: 150f60e0-4710-44e5-88e0-56bcb0b6b4a8 version: -1 name: Convert Sigma to Qradar query description: Allows converting a Sigma Rule indicator into a SIEM query. scriptName: SigmaConverttoQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "24" scriptarguments: SIEM: simple: Qradar indicator: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sigmaruleraw iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1770, "y": 1325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "23": id: "23" taskid: 5cd94a92-d4c3-4859-8044-5ec1c3590a43 type: condition task: id: 5cd94a92-d4c3-4859-8044-5ec1c3590a43 version: -1 name: Is Qradar installed description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "33" "yes": - "22" scriptarguments: brandname: simple: QRadar v3 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1770, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "24": id: "24" taskid: 6d8c5071-a9bc-4be2-80f8-cf88fc54f9c4 type: regular task: id: 6d8c5071-a9bc-4be2-80f8-cf88fc54f9c4 version: -1 name: Send Query to Qradar description: Creates a new asynchronous Ariel search. Returns the search ID. Search status and results can be polled by sending the search ID to the 'qradar-search-status-get' and 'qradar-search-results-get' commands. Accepts SELECT query expressions only. script: '|||qradar-search-create' type: regular iscommand: true brand: "" nexttasks: '#none#': - "29" scriptarguments: query_expression: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: ERROR - - operator: isEqualString left: value: simple: Sigma.format iscontext: true right: value: simple: qradar accessor: query separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1770, "y": 1505 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "25": id: "25" taskid: a6186ef4-8d10-4440-810a-2cdf0c483061 type: title task: id: a6186ef4-8d10-4440-810a-2cdf0c483061 version: -1 name: Carbon Black type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "27" separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 690 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "26": id: "26" taskid: 69e7f5e7-dfbe-461f-8c38-b28c2c8d5d27 type: regular task: id: 69e7f5e7-dfbe-461f-8c38-b28c2c8d5d27 version: -1 name: Convert Sigma to Carbon Black query description: Allows converting a Sigma Rule indicator into a SIEM query. scriptName: SigmaConverttoQuery type: regular iscommand: false brand: "" nexttasks: '#none#': - "28" scriptarguments: SIEM: simple: Carbon_Black indicator: complex: root: foundIndicators filters: - - operator: isNotEqualString left: value: simple: foundIndicators.sigmaruleraw iscontext: true right: value: simple: n/a accessor: value separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 1325 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "27": id: "27" taskid: 76019c32-f4b6-4b9e-8b70-3ecb4c4a5f02 type: condition task: id: 76019c32-f4b6-4b9e-8b70-3ecb4c4a5f02 version: -1 name: Is Carbon Black installed description: Returns 'yes' if integration brand is available. Otherwise returns 'no'. scriptName: IsIntegrationAvailable type: condition iscommand: false brand: "" nexttasks: "no": - "33" "yes": - "26" scriptarguments: brandname: simple: Carbon Black Endpoint Standard v3 separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 900 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "28": id: "28" taskid: 1025d4d5-33db-4747-8c17-e0c801b9e7b3 type: regular task: id: 1025d4d5-33db-4747-8c17-e0c801b9e7b3 version: -1 name: Send Query to Carbon Black description: Gets alert details, including alert metadata and the event associated with the alert. script: Carbon Black Endpoint Standard v3|||cbd-alerts-search type: regular iscommand: true brand: Carbon Black Endpoint Standard v3 nexttasks: '#none#': - "29" scriptarguments: query: complex: root: Sigma filters: - - operator: notStartWith left: value: simple: Sigma.query iscontext: true right: value: simple: ERROR - - operator: isEqualString left: value: simple: Sigma.format iscontext: true right: value: simple: carbon_black accessor: query separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 2200, "y": 1505 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "29": id: "29" taskid: efabe847-b0ed-4422-8b38-c69cf49ba387 type: title task: id: efabe847-b0ed-4422-8b38-c69cf49ba387 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1125, "y": 1710 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "31": id: "31" taskid: 9278ba3e-09fd-4aac-8b82-13085eb193b9 type: title task: id: 9278ba3e-09fd-4aac-8b82-13085eb193b9 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 260, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "32": id: "32" taskid: 07124b2c-af3d-448c-8ca7-de8feba71c1d type: title task: id: 07124b2c-af3d-448c-8ca7-de8feba71c1d version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1125, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false "33": id: "33" taskid: 097dfcc1-fd32-442e-8215-8827b015e948 type: title task: id: 097dfcc1-fd32-442e-8215-8827b015e948 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false continueonerrortype: "" view: |- { "position": { "x": 1990, "y": 1140 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false view: |- { "linkLabelsPosition": {}, "paper": { "dimensions": { "height": 1725, "width": 2530, "x": 50, "y": 50 } } } inputs: - key: Query value: simple: type:"Sigma Rule" required: false description: "" playbookInputQuery: inputSections: - inputs: - Query name: General (Inputs group) description: Generic group for inputs. outputSections: - outputs: [] name: General (Outputs group) description: Generic group for outputs. outputs: [] tests: - No tests (auto formatted) fromversion: 6.10.0 contentitemexportablefields: contentitemfields: {}