remram on Sigma – A shareable detection format for security professionals

YAML with dots in keys...

    selection:
        userIdentity.type: Root

I wish we could go back to the JSON days.

Comments