Skip to content

Conversation

@sifex
Copy link
Collaborator

@sifex sifex commented Dec 18, 2025

Context

This pull request updates the documentation for Sigma rules, filters, and correlations to standardize code annotation syntax, improve clarity, and correct minor typos. The main change is replacing the old inline comment format (// [!code ...]) with the new hash-based format (# [!code ...]) across all example YAML blocks. Additionally, there are improvements to filter documentation, expanded filter usage examples, and some minor corrections to field values and explanatory text.

Standardization and Syntax Updates

  • Updated all code annotation comments in YAML examples from // [!code ...] to # [!code ...] for consistency and clarity in docs/basics/conditions.md, docs/basics/log-sources.md, docs/basics/rules.md, docs/meta/correlations.md, docs/meta/filters.md, and docs/meta/index.md. [1] [2] [3] [4] [5] [6]

Documentation Improvements for Filters

  • Enhanced the Sigma Filters documentation with expanded examples, including how to reference all rules within a logsource and clarified the distinction between exclusion and inclusion filters. Added code-group blocks and improved explanatory text. [1] [2]

Minor Corrections and Typos

  • Fixed typos such as changing "build-in" to "built-in" and corrected YAML field values for consistency (e.g., using double quotes instead of single quotes, and aligning indentation). [1] [2] [3]

Cleanup of Deprecated or Redundant Sections

  • Removed redundant or deprecated informational and falsepositive sections from correlation and filter examples to streamline the documentation. [1] [2] [3]

Formatting and List Consistency

  • Standardized bullet point formatting in lists and code comments for better readability and consistency throughout the documentation. [1] [2]

- Updated comments in conditions.md to use '#' instead of '//'
- Standardized formatting in log-sources.md, rules.md, and pipelines.md
- Enhanced correlation examples in correlations.md for better readability
- Improved filter documentation in filters.md, including new examples for inclusion and exclusion
- Updated package.json dependencies to latest versions
@sifex sifex merged commit dbed1ac into main Dec 18, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants