Platform · Detection Engineering

Sigma you write,
test and version.

Sigma rule testing against your own history. Write or import Sigma, backtest it, run it in shadow, and you decide the rollout.

Sign upWatch Scout hunt
Native Sigma compilerSigmaHQ importBacktestShadow modeVersionedWatcher health
Watcher · rundll32 from Office
title: Rundll32 spawned by Office
logsource: { category: process_creation, product: windows }
detection:
  selection:
    ParentImage|endswith: ['\WINWORD.EXE', '\EXCEL.EXE']
    Image|endswith: '\rundll32.exe'
  condition: selection
tags: [attack.t1218.011, attack.defense_evasion]
Compiles · bound toprocess_activityprocess.parent.file.nameprocess.file.name

Would have fired

14 · 30d

Entities

6 hosts

Expected / day

0.5

Sample

WKS-2231 · m.reyes

Check against history: 1d · 7d · 14d · 30dOffShadowOn

Test before you turn it on

Backtest a rule against your own history first: what would have fired, on which entities, how often.

Shadow, then on

Shadow mode records what a rule would have done. Turn it on once you trust it.

Versioned like code

Every version keeps its author, note and diff. Restore any. Every firing names the version that fired.

02History and deployment

One rule, every organisation you run.

Write the rule once. When it is right, deploy it to one organisation or all of them, and find it again by ATT&CK technique.

  • Import SigmaHQ. Community rules land as watchers, off by default, ready to backtest before they go live.
  • Tested on real attacks. Rules are tested against 1,500+ recorded attacks before they go live.
  • Library, your languages. Templates in KQL, SPL, Sigma, YARA and more, ready to adapt.
  • From hunt to watcher. Scout drafts a watcher from confirmed findings. You backtest it and set it live.
History · rundll32 from Office
  1. v4Add EXCEL.EXE parent; drop noisy updater pathm.reyes · today
  2. v3Bind to OCSF process_activity surfacej.okafor · 6d agoRestore as new version
  3. v2Tag attack.t1218.011m.reyes · 12d agoRestore as new version
  4. v1Drafted from hunt H-118 findingsScout · 14d agoRestore as new version
diff v3 → v4
+ ParentImage|endswith: ['\WINWORD.EXE', '\EXCEL.EXE']
- ParentImage|endswith: '\WINWORD.EXE'
Last firing labelled v4 · 09:14 · Acme CorpActions: Raise finding · Tag graph

03In the loop

Detections are the memory of every hunt.

A confirmed pattern becomes a watcher. The watcher raises an insight. The insight starts a hunt. Each pass leaves a sharper rule.

Federated SIEMLake: BetaYour logs, your lake or ours. One query.
Threat HuntingHypotheses, checkpoints, playbooks.
AI Alert TriageEvery finding pre-read by Scout.
Threat IntelligenceSTIX in, one graph that remembers.

Open by design

Sigma

Compiled natively onto the OCSF lake. Write your own or import SigmaHQ.

MITRE ATT&CK

Tag rules by technique; search the Library by technique.

OCSF v1.3

Write one rule; it runs on every matching source.

KQL · SPL · ES|QL

Library templates in the languages your other tools already speak.

Questions

Frequently asked questions

How does Huntbase run Sigma rules?

With a native Sigma compiler that runs rules directly on the OCSF data lake, so you do not maintain a hand-translated copy of each rule.

Can I import SigmaHQ rules?

Yes. Imported SigmaHQ rules land as watchers, switched off by default, so nothing pages anyone until you have tested and enabled it.

How does Sigma rule testing work?

Backtest a rule against your own history to see what it would have fired on. Then run it in shadow mode, which records hits without alerting, and turn it on when you trust it.

How do I know a rule is still healthy?

Every version keeps its author, note and diff, and you can restore any of them. Watcher health shows which rules are running as expected.

Your rules.
Your history.
Your rollout.

Detections tested on your data before they page anyone.

Sign upWatch Scout huntOr book a demo
  1. 01Sign up
  2. 02Run a guided hunt on the sample workspace, no connector needed
  3. 03Connect your own sources when you're ready