https://pixelotes.com/tags/opensearch/Recent content in opensearch on Raúl PastorHugoenSun, 01 Nov 2026 00:00:00 +0000https://pixelotes.com/blog/sigma-rules/Sun, 01 Nov 2026 00:00:00 +0000https://pixelotes.com/blog/sigma-rules/<p>In the <a href="https://pixelotes.com/blog/supply-chain-security/">previous article</a> I wrote a handful of KQL queries to hunt for a backdoored IDE extension. They work in Microsoft Sentinel and Defender. They are useless in Splunk, Elastic or OpenSearch.</p> <p>That is the core problem of detection engineering: every SIEM speaks its own language, and detection knowledge gets locked inside whichever product you happen to run. Sigma fixes that.</p> <h2 id="what-sigma-is">What Sigma is</h2> <p><a href="https://github.com/SigmaHQ/sigma">Sigma</a> is an open, generic signature format for log events. A Sigma rule is a YAML file that describes <em>what</em> to look for (which log source, which fields, which values) without saying <em>how</em> a specific SIEM should query it. A converter then translates the rule into the target query language.</p>