Two Pipelines, One Choice: Converting Sigma to QRadar AQL
·1288 words·7 mins·
loading
·
loading
IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.