Blog
Product UpdatesHow to Choose Which Sigma Rules to Deploy First
Event ID 4688 carries no command line until you turn on one Group Policy setting. Audit Process Creation logs the new process name and the parent, and that is all. Enable "Include command line in…
2026-07-288 min read
Product UpdatesWhat Is a Managed Sigma Rule Service?
git clone https://github.com/SigmaHQ/sigma gives you 4,244 YAML files. On 31 July 2026 the repository carried 3,137 rules under rules/, 470 under rules-emerging-threats/, 140 under…
2026-07-248 min read
Product UpdatesWhat Is Rule Validation in HuntRule?
Two selections, AND-ed together. One asks for Image|endswith: '\rundll32.exe', the other for Image|endswith: '\regsvr32.exe'. The YAML is valid. Every linter you own will pass it. It will also never…
2026-07-128 min read
Product UpdatesWhat Is a Rule Lifecycle in HuntRule?
A rule enters the catalog as a line of git diff output and leaves it as a D1 row with lifecycle = 'published'. Everything between those two facts is the lifecycle. Two vocabularies drive it, and they…
2026-07-088 min read
Product UpdatesWhat Is HuntRule? A Sigma Rule Catalog for Detection Engineers
git clone https://github.com/SigmaHQ/sigma gives you every rule and almost none of what you need to deploy one. git clone https://github.com/SigmaHQ/sigma find sigma/rules -name '*.yml' | head -3 You…
2026-06-257 min read