Ibm

loading · loading ·

Two Pipelines, One Choice: Converting Sigma to QRadar AQL

26 August 2026·1288 words·7 mins· loading · loading

Sigma Aql Qradar Pysigma Ibm Detection-as-Code Conversion Payload-Scan Performance Siem Blue-Team Mitre-Attack Threat-Detection

IBM’s pySigma backend ships two conversion pipelines with very different trade-offs, and one of them fails open. Here’s how the converter picks, and what it records.

Phase 0: Interrogating QRadar's API Before You Trust It

23 August 2026·1109 words·6 mins· loading · loading

Qradar Rest-Api Sigma Aql Detection-as-Code Siem Ariel Saved-Searches Cre-Rules Ibm Blue-Team Phase-Zero Architecture

Don’t assume what a SIEM’s REST API can do. Write a prober that asks the live instance, and let the answer shape the architecture.

What The Sigma: Translating Detections Is Solved, Trusting Them Isn't

20 August 2026·1041 words·5 mins· loading · loading

Detection-as-Code Sigma Qradar Aql Ibm Siem Blue-Team Soc Mitre-Attack Ci-Cd Pysigma Threat-Detection Dfir

Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.

↑