Find and preview Sigma Investigation Playbooks
The Sigma playbooks in this repo are Human-Centered Investigation Playbooks — one per Sigma rule. Instead of listing procedural steps, each playbook poses investigative questions an analyst asks when working an alert. Every question is paired with the context for why it matters, the data source that answers it, a relative time range, and a ready-to-run query.
The format follows the Human-Centered Investigation Playbook standard (v1.1). Playbooks are readable by analysts and parseable by tools like Security Onion.
name, the playbook's own id,
description, and the detection_id linking back to the source
Sigma rule (the file is named for this detection_id).question — the plain-language thing the analyst is trying to answercontext — why it matters and how to read the resultrange — the relative time window to search (e.g. +/-5m, -7d)query — a ready-to-run Sigma fragment; %placeholders%
are filled from the triggering event at investigation time. (The standard's
queries list is collapsed to a single Sigma query here, with
aggregation carried inside it.)answer_sources (optional) — the data sources that can
answer the question, when not already implied by the queryname: <Playbook name>
id: <Playbook UUIDv4>
description: |
<What the rule detects and how to investigate it>
type: detection
detection_id: <Source Sigma rule UUID>
detection_category: ''
detection_type: sigma
contributors:
- <At least one contributor>
created: <YYYY-MM-DD>
questions:
- question: <Investigation question>
context: <Why it matters / how to read the answer>
range: <Relative time window, e.g. +/-5m, -7d>
answer_sources: # optional — data sources that answer the question
- <e.g. process_creation, asset_inventory>
query: |
<Sigma fragment; %placeholders% bind to the alert>