Sigma
On Detections, select Import Sigma and paste one rule, or several separated by ---. Each rule is compiled to a native rule: the log source is mapped to XenXDR data sources, field names are mapped through the dictionary, modifiers (contains, startswith, endswith, re, all, wildcards) are translated, and N of selections are expanded.
Imported rules arrive disabled, with the original Sigma text kept as the rule's query. Review each one, preview it, then enable it. A rule that fails to compile is reported with the reason and is not imported.
Each import creates new rules. Importing the same Sigma rule again gives you a second copy, so update an imported rule in the editor instead.
KQL and EQL
The rule editor also accepts a subset of KQL and EQL as the query language. The editor says immediately whether a query compiles and names any construct it cannot handle. EQL sequences are not supported; use a sequence rule instead.
What compiles well
- Process, network, file and registry detections on Sysmon and Windows event fields.
- Authentication detections on Windows Security and Linux authentication events.
- Counts, with a threshold rule. Sigma aggregation conditions such as
| count()are not supported.