We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#field-name-aliases
Need to write a test rule first. (@YamatoSecurity )