Sigma Rules Event

The following article exclusively pertains to a Graylog Security feature or functionality. Graylog Security is a part of the Graylog centralized log management platform and requires a separate license. Contact the Graylog Sales team for more information on this product.

Sigma is an open, YAML-based format for describing detection logic that identifies suspicious or malicious behavior in log data. Designed to be platform-independent, Sigma rules describe common attack patterns, such as failed login attempts or abnormal PowerShell activity, that can be applied across different security tools and logging systems.

Graylog imports Sigma rules directly into Identify Events. Each imported rule becomes a Graylog event definition that is matched against incoming logs. Sigma rules events are created using the event definition workflow and support scheduling, filtering, and alerting like other event types in Graylog.

Important: Upgrading to Graylog 7.2? As part of the upgrade, a migration runs automatically and converts every Sigma rule already on the system into an event definition. No manual re-import is needed. Pre-existing Sigma rules function as before and can be edited through the Event Definition wizard as usual. They appear alongside other event definitions on the Identify Events page.

Prerequisites

A Graylog Security license is required.
Graylog 7.2 or higher is required for the workflow described here.
Graylog Illuminate is recommended for ready-made Sigma content.

Configuration Options

A Sigma Rule event definition includes the following configuration options:

Search Query	The query Graylog translates from the imported Sigma rule. Fully editable afterward, the same as a query written directly for a Filter & Aggregation event definition.
Search Filters (optional)	Refines which messages match, using the same search filters available to any other event definition.
Streams and Categories	The streams the search should include.
Search within the last	The window of time each execution searches backward to match messages.
Use Cron Scheduling	Enables custom scheduling using a cron expression. See Cron Scheduling for Event Definitions.
Execute search every	How frequently the search runs when cron scheduling isn't used.
Enable	Select this option to execute this event definition automatically.
Create Events for Definition if...	Filter has results, or Aggregation of results reaches a threshold. Select the latter to rebuild a Sigma `event_count` or `value_count` correlation as an aggregation. See Sigma Correlation Rules, below.
Event Limit	The maximum number of events created per execution; excess events are suppressed.
Tags (optional)	Free-text labels that propagate onto every event this definition produces.
Tactics/Techniques (optional)	MITRE ATT&CK tactic, technique, or sub-technique IDs. Automatically populated from the imported rule's own tags (see below); add or edit them by picking from the Illuminate-installed MITRE ATT&CK catalog or typing an ID in the form TA0000, T0000, or T0000.000.
Event Fields (optional)	Custom fields that copy additional data from the source log into generated events. None exist until one is added.
Event Summary Template	The template used to generate the event and alert summaries.
Event Procedures	Procedures attached to the event definition. Select Add Event Procedure to attach one. See Event Procedures.
Notifications (optional)	Turns events from this definition into alerts by attaching one or more notifications. Select Add notification to attach an existing notification, or Manage Notifications to open the notification settings.
Grace Period (optional)	How long to wait before sending notifications again. By default, notifications are sent every time an alert occurs. For events with keys, the grace period applies separately to each key value.
Message Backlog (optional)	The number of messages to include in notifications.

Tags and Tactics/Techniques

Sigma rules carry a single tags field that mixes two kinds of information: MITRE ATT&CK IDs and generic, rule-author-defined tags. On import, Graylog splits that field between the event definition's two tagging fields:

Tags prefixed with attack. are recognized as MITRE ATT&CK IDs. The prefix is stripped, and the remaining ID (for example, attack.t1059 becomes T1059) is added to the Tactics/Techniques field.
Any other tag, or one that isn't a valid MITRE tactic/technique ID, is added to the Tags field instead.

Both fields are then included on any alerts and events the event definition triggers.

Example Use Case: Tagging a Brute-Force Detection

Importing a rule tagged attack.ta0006, attack.t1110, authentication, and brute-force, populates the resulting event definition's Tactics/Techniques field with TA0006 and T1110 and its Tags field with authentication and brute-force. Alerts and events triggered by the event definition include all four values; you can filter and report on them alongside other MITRE-mapped alerts.

Create Event Definition

Sigma rule source files are authored and edited outside Graylog; there's no built-in YAML editor. When a rule is imported from a Git repository or an uploaded file, Graylog translates the rule into a search query and creates an event definition.

To create a Sigma Rule event definition:

Navigate to Alerts > Event Definitions.
Select the dropdown arrow next to Create event definition, then choose an import method:
- Sigma Git Import: Import one or more rules from a saved Git repository connection.
- Sigma File Import: Upload a .yml/.yaml rule file, or a .zip archive of several, from the local file system.
Search for and select the rule to import. You can select multiple rules. Use the search box beneath the rule list to find rules by title, file name, product, or tags, then select the checkbox beside each rule.
Set the following options for each selected rule:
- Event Summary Template: The template used to generate the event and alert summaries.
- Search Filters: Optional filters that refine which messages match.
- Streams and Categories: The streams the search should include.
- Search within the last: The window of time each execution searches backward to match messages.
- Use Cron Scheduling and Execute search every: How often the search runs, either on a cron schedule or at a fixed interval.
- Enable: Whether the event definition executes automatically.
- Notifications: The notifications to trigger when the event definition creates an event.
- Event Procedures: Select Add Event Procedure to attach a procedure to the rule.
To apply one rule's options to all selected rules, select Copy options to all selected rules.
Review the Summary, which lists each selected rule with its event definition options
Finish the import to create the event definition.

Monitor Event

A Sigma rule event definition monitors the log data in your selected streams on a recurring schedule. On each run, Graylog executes the rule’s query against those streams and evaluates the messages within the search window. When the results meet the defined condition, Graylog creates an event.

Each event triggers the event definition’s notifications, which send alerts through a configured channel, such as Slack or email.

The query, schedule, search window, streams, and notifications can all be configured in the Event Definition wizard. Changes apply only to that event definition and never modify the original Sigma rule.

Sigma Correlation Rules

Direct import of event_count and value_count correlation rules, which use Sigma's correlation syntax, is no longer supported. The same detections can still be built, with more flexibility, directly on imported event definitions:

For an event_count or value_count correlation: Import the base rule, then select the Aggregation of results reaches a threshold option on the resulting event definition and use any of Graylog's aggregation functions.
For a temporal_ordered correlation (rule A, then rule B, then rule C): Import each base rule, then create a separate event correlation definition that references them in sequence. See Correlation Events for details.

Important: Correlation event definitions created from Sigma rules before 7.2 are unaffected and continue to run as configured. This change applies only to new Sigma correlation imports.