Replies: 1 comment 1 reply
-
|
Please take a look at correlation rules https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
I'm already read it carefully but still can't figure out how to compare current counter with prevoius counter value. |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I mean is it possible to describe using sigma rules?
Beta Was this translation helpful? Give feedback.
All reactions