Processing Pipelines

How a generic Sigma rule becomes a real backend query: field mapping and 26 transformation types.

Sigma Rules for MITRE ATT&CK