# sigma convert -t kusto --without-pipeline (4 Nov 2026). See README for pipeline results. Prepend a table (CommonSecurityLog or Syslog) and map fields yourself.

// zyxel_gs1900_admin_login.yml
"login" or "logged in" or "authenticat"

// zyxel_gs1900_config_change.yml
"configuration" or "running-config" or "startup-config" or "config file"

// zyxel_gs1900_internal_webui_access.yml
((dst_ip in~ ("192.0.2.20", "192.0.2.21")) and (dst_port in~ ("80", "443"))) and (not(ipv4_is_in_range(src_ip, "10.99.0.0/24")))

// zyxel_gs1900_mgmt_inbound_internet.yml
((dst_ip in~ ("192.0.2.20", "192.0.2.21")) and (dst_port in~ ("80", "443"))) and (not((ipv4_is_in_range(src_ip, "10.0.0.0/8") or ipv4_is_in_range(src_ip, "172.16.0.0/12") or ipv4_is_in_range(src_ip, "192.168.0.0/16"))))

// zyxel_gs1900_reboot.yml
"reboot" or "cold start" or "warm start" or "restart"

// zyxel_gs1900_switch_outbound.yml
(src_ip in~ ("192.0.2.20", "192.0.2.21")) and (not((ipv4_is_in_range(dst_ip, "10.0.0.0/8") or ipv4_is_in_range(dst_ip, "172.16.0.0/12") or ipv4_is_in_range(dst_ip, "192.168.0.0/16"))))
