Deploying Detections Without Making a Mess
·1048 words·5 mins·
loading
·
loading
Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.