Build Your Detection Package
A collection shaped around your environment. Choose the telemetry you collect, set your selection policy, and take the original Sigma rules with you.
Starting RuleDNS Query to Wildcard DNS Services - Network
Product, telemetry, and policy were prefilled from this rule. Adjust the selections to shape your package.
STEP 2 / 4
Which Telemetry Do You Collect?
Select sources that are already collected and searchable. These are your declarations; field availability and collection configuration still need verification.