Skip to content
Made in the UK

SIEM for MSPs

How do Sigma rules work in an MDR platform?

By , CTO, CybaVerse. Last reviewed

Sigma rules are detection logic written in an open, vendor-neutral YAML format. In an MDR platform they run against normalised log data; when a rule matches, it raises an alert that analysts triage. Because the format is open, the same rule can be shared, reviewed and reused across many clients and tools.

This page is part of our SIEM for MSPs guide.

What is a Sigma rule?

A Sigma rule describes suspicious activity, such as a process launched in an unusual way, in a structured, readable file. It names the log source, the fields to match and a severity. Sigma is maintained as an open project by SigmaHQ, so rules can be read, tested and improved by the wider security community.

Part of a ruleWhat it does
Log sourceWhich type of data the rule applies to
DetectionThe field values or patterns to match
LevelHow serious a match is
TagsLinks to frameworks such as MITRE ATT&CK

How does an MDR platform use Sigma rules, step by step?

An MDR platform turns rules into alerts that people can act on. The rule alone is only the start; normalisation, tuning and human triage decide whether an alert becomes a useful case. The steps below show the path from raw log to analyst decision, and where an MSP should ask questions.

  1. Step 1: Normalise incoming data

    Logs are mapped to a common schema so one rule fits many sources.

  2. Step 2: Run the rule set

    Rules from the SigmaHQ catalogue, plus the provider's own, are evaluated against the data.

  3. Step 3: Tune for each client

    Known good behaviour is excluded so rules fire on genuine anomalies.

  4. Step 4: Triage the alert

    An analyst reviews the evidence and decides whether to open or update a case.

What should MSPs check about rule coverage?

Ask how well the rule library covers the sources your clients actually use. The public SigmaHQ catalogue is rich for Windows and thinner for sources further away from it, such as some network devices and niche SaaS. A good provider is honest about gaps and shows real detections during a proof of concept.

  • Which of my clients' sources have tested rules today?
  • How are rules tuned per tenant, and who approves exclusions?
  • How are rules mapped to MITRE ATT&CK techniques?

Where does CybaOps fit with Sigma rules?

CybaOps detection is being built on the open Sigma rule standard, running against data normalised to the OCSF schema. The CybaVerse SOC triages activity across client environments today, and incidents are worked as cases so every step is recorded for the MSP and client.

  • CybaOps detection is being built on the open Sigma rule standard.
  • CybaOps normalises security data to the open OCSF schema.
  • We are building a correlation engine into CybaOps that links related alerts into a single incident.
  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.

Sigma rules

How a Sigma rule becomes an MDR case

Sigma rules are detection logic written in an open, vendor-neutral YAML format.

01 Alerts from

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Sigma rules

02 The 4-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • MDR in
  • CybaCore
  • CybaEdge
  • CybaOne

What else do MSPs ask about Sigma?

Is Sigma tied to one SIEM?

No. Sigma is vendor-neutral, which is why it suits multi-client MSP work. Rules are written once in a common format and converted for the platform in use, so detection logic can be shared and reused consistently across different clients.

Can MSPs write their own rules?

Sigma's format is open, so custom rules are possible. Ask your provider how custom rules are reviewed and tested before they go live. Testing against real data helps avoid rules that miss threats or create a flood of noisy alerts.

Does more rules mean better detection?

Not on its own. Tuning and triage matter as much as rule count. Well-chosen rules that are tested and maintained catch real threats with less noise, while large numbers of untuned rules can bury genuine alerts among false positives.

What should you do next?

  1. List which clients already send logs anywhere, and who reads them today.
  2. Pick two clients to start with and agree what good looks like.
  3. Book a CybaOps demo to see the workflow on real data.

See CybaOps | Become a CybaVerse partner

Related: How do MSPs run a SIEM without a 24/7 SOC? and What is OCSF and why does it matter for MSP log normalisation?

See the workflow on real data.

Book a CybaOps demo