sigma-cli: tags are not log fields

A tag is a keyword on the file

The tags list is text in the YAML: labels the author chose, sometimes a tactic name, sometimes an internal word. Those strings are not fields the detection tests unless the detection section also names them, which you check separately.

Quoting a tag is quoting the file. It is not quoting a log row.

A search for the word is a different question

If you search a SIEM for the tag string itself, you are searching for that string. Those hits are not automatically the rule’s hits. The rule’s hits are rows from the query that came from the detection, and only when you ran that query.

If you did not run it, write “rule query not run.” Do not substitute a keyword search.

What to file

File the rule id and the tags as keywords. File a hit count only for the query you ran, and name that query. A tag that looks like a technique name is still a keyword until a cited log row shows the activity.

Worked case: a tag string searched as the rule

The lab rule’s tags include lab.inventory. The detection looks for a process path. A draft searches the lab index for the text lab.inventory, gets 9 events, and files them as the rule’s hits. The converted query was not run.

The note says lab.inventory is a tag on the file. The 9 events are a search for that string. The rule query was not run, so those 9 are not filed as the rule. The process-path test stays unread.

rule tags: lab.inventory
detection tests: a process path
search actually run: the text lab.inventory, 9 events
rule query: not run
write: tag versus a keyword search
not: the rule returned 9