Skip to content

A readme for placeholder rules #5864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zendannyy wants to merge 4 commits into
base: master
Choose a base branch
from
Open

A readme for placeholder rules #5864

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
eb68ccf
readme for placeholder rules
zendannyy Feb 12, 2026
06926c6
Merge branch 'master' into placeholder_rules
zendannyy Feb 12, 2026
ecd4247
Apply suggestions from code review
swachchhanda000 Mar 9, 2026
569e426
Merge branch 'master' into placeholder_rules
swachchhanda000 Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 19 additions & 1 deletion rules-placeholder/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,19 @@
TBD
# Placeholder Rules
Comment thread
swachchhanda000 marked this conversation as resolved.

These are rules that are flexible detection templates that can be customized for your environments or use cases. Examples include rules that would require a domain or workstation variation that is specific to the company environment. This would vary on a case-by-case basis.

As a result, placeholder rules serve as an abstract detection template, where you adjust the placeholder value to fit your use case.

### Placeholder Transformations
Placeholders can be mapped to the following:

- `value_placeholders`
- `query_expression_placeholders`
- `wildcard_placeholders`

As stated in the included [documentation](https://blog.sigmahq.io/building-flexible-detections-with-sigma-placeholders-7c1b814e2860), this is to keep private rules clean and make any environment-specific information reusable to the community.
You use one of the placeholder transformations above, and future users of the rule can simply adjust the value to their use case.

### Reference

[Sigma Blog Post](https://blog.sigmahq.io/building-flexible-detections-with-sigma-placeholders-7c1b814e2860)