sigma-cli: the title is not the rule id

The id is the identity

A Sigma rule’s id is the stable name of that file’s detection. Conversions, reviews, and tickets that mean one rule should carry that id. Editing the detection text does not by itself change the id, and copying the title into a new file does not keep the old id.

If the id cell is blank, you do not yet have an identity to cite. Write “id not in this file” and stop there. Do not borrow an id from a neighboring file because the titles look alike.

The title is a label

The title is a short description the author typed. Two files can carry the same title and still test different fields. A search, a dashboard, or a ticket that quotes only the title has not said which file it means.

Renaming the title does not merge two ids, and it does not split one. The label can change while the id stays. Track the id when you compare a before and an after.

What to file

File the id, then the title as a label if you need the human string. When two files share a title, file both ids and the difference in their detection text. A hit count has to name the id whose query ran, not only the words of the title.

Worked case: one title on two lab rules

rules/inventory-a.yml and rules/inventory-b.yml are both titled Scheduled lab inventory. The first id is 11111111-2222-4333-8444-555555555551 and its detection requires ParentImage to be the lab scheduler. The second id ends in 552 and has no parent test. A draft says the inventory rule returned 9 events.

The note refuses the singular “the inventory rule.” The 9 events came from the converted text of the id ending in 552, which is the file without the parent test. The other id is a different detection that happens to wear the same title.

title on both files: Scheduled lab inventory
id ...551: also requires the lab scheduler as parent
id ...552: no parent test
9 events: query from id ...552
write: that id, that title as a label
not: the inventory rule, as if there were one