SigmaHQ Sysmon rules are now in the catalog
A more notable week this time. The catalog now includes a SigmaHQ library, plus a few catalog and destination improvements.
Back in the introductory post I mentioned something Sigma related might be coming. That is now in the catalog.
SigmaHQ library
The catalog has a new source: SigmaHQ. These samples are generated from SigmaHQ Windows rules as Sysmon-style events, so you can insert activity that matches a given rule without having to reproduce it yourself.
Each sample maps to a Sigma rule and links back to the original on GitHub. They are tagged Synthetic so you can tell them apart from captured EVTX collections. Filter Source to SigmaHQ to browse just those samples.
Coverage is Windows rules that can be represented as Sysmon telemetry. The library will keep growing as matching rules show up upstream.
Improvements
- You can now filter the catalog by event type, for example Sysmon 1 (Process Creation) or Windows Security 4624.
- Catalog samples now show when they were added, and you can sort by date added or last updated.
- Windows Security, System, and Application events sent to Splunk now ingest as XML Windows Event Log, so field extraction matches how Sysmon already behaved.
Bugs
- Fixed insert progress getting lost if you navigated away or refreshed while a job was running.
If you would like to try logcannon.com you can create a free account, if you have any feedback or ideas for improvement I'd love to hear it, you can reach out to me directly on LinkedIn or X.