Defensive / Blue

Sigma Rules

Generic detection rule format convertible to SIEM queries.

intermediate

Any

Defense

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Writing detections for techniques you just learned to attack.

Author Sigma; convert with sigma-cli to Splunk/Elastic/etc.

Red teamers who understand detection become elite operators.

Commands & usage

sigma convert -t splunk rule.yml

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

osquery

SQL-powered endpoint visibility agent.

Suricata

Network IDS/IPS and network security monitoring engine.

Wazuh

Open-source XDR/SIEM platform for log analysis and FIM.

Fail2ban

Bans IPs that show malicious signs (e.g., too many SSH failures).