Saved-Searches

loading · loading ·

Deploying Detections Without Making a Mess

1 September 2026·1048 words·5 mins· loading · loading

Qradar Detection-as-Code Deployment Idempotence Ariel Saved-Searches Sigma Aql Siem Ci-Cd Blue-Team Automation Uuid

Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.

Phase 0: Interrogating QRadar's API Before You Trust It

23 August 2026·1109 words·6 mins· loading · loading

Qradar Rest-Api Sigma Aql Detection-as-Code Siem Ariel Saved-Searches Cre-Rules Ibm Blue-Team Phase-Zero Architecture

Don’t assume what a SIEM’s REST API can do. Write a prober that asks the live instance, and let the answer shape the architecture.

↑