Vaigilmanual

Detection rules, Sigma and correlations

Rules with fixtures, Sigma import, a trial ring, and suppressions that end.

In the consoleDetections

  1. Install the shipped rules

    vaigil detect pack install
vaigil detect test

    Each rule carries fixtures it must match and must not, MITRE ATT&CK technique IDs, and a line on what it does not catch.

  2. Bring your own, in the open standard

    vaigil sigma import ./rules

  3. Trial a rule before it reaches the queue

    vaigil detect ring RULE trial --because "new rule"
vaigil detect stats
vaigil detect ring RULE live --because "a week without a false positive"

    In the trial ring a rule records what it would raise, and its record earns it the queue.

  4. Suppress, until a date

    vaigil detect suppress RULE user.name=svc-backup --owner dana --until 2026-12-31 --because "known job"

Correlations raise a finding about several events across rules and platforms, once their window closes; vaigil correlate demo shows one end to end.