value comparison #62
-
|
Hi all, Is there a way to compare column values with specific values such as EventId > 10? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
|
Duplicate with discussion https://github.com/SigmaHQ/sigma/discussions/4035 here. |
Beta Was this translation helpful? Give feedback.
-
|
Yes, the very basic version of a detection item compares to a specific value: |
Beta Was this translation helpful? Give feedback.
Yes, the very basic version of a detection item compares to a specific value:
EventID: 10. Modifiers can be used to add numeric conditions, e.g.EventID|gt: 10does exactly what you describe above.