In Search, you can explore the Threat Detection Marketplace (TDM), the world's largest collection of detection rules and hunting queries.

Each piece of content is initially written in Sigma, the common language for cyber defense, and then automatically translated into the native formats of various SIEMs, EDRs, and XDRs. Sigma rules are mapped to MITRE ATT&CK® and enriched with intelligence on the related threats.

Detection rules are ranked and displayed as listings with key details. You can browse, search for, and filter Sigma rules.

To access the Search page, go to the Threat Detection Marketplace and select the Search tab.

The search bar is located in the upper left corner of the page. You can choose between three search modes: Standard, Lucene, and Light.

This mode is enabled by default. Make a standard full-text search throughout all content in the Threat Detection Marketplace.

When you start typing the query, suggestions appear. Select one of them or finish typing and click the magnifying glass icon or press Enter (Windows)/Return (Mac).

Suggested results may be based on the matches in the following attributes:

Search shows the core statistics on your current search results.

To enable this mode, click the up arrow next to Standard, and pick the Lucene option in the dropdown.

Use Lucene syntax to compose sophisticated queries: filter out content, combine search terms using different logical operators, and much more. To learn more about using Lucene, select the question mark icon on the right of the Lucene label. To see the list of all available fields along with their types and possible values, go to the Lucene section of this Guide.

To enable this mode, click the up arrow next to Standard, and pick the Light Search option in the dropdown.

Using Light Search, you can find detections by entering a natural language query, which the system interprets and enriches with known aliases and alternative references, enabling the search to match all relevant variations. For example, if you enter the actor name APT28, the system automatically expands the query with its known aliases, such as Fancy Bear and Pawn Storm.

Turn on the AI Boost toggle to boost your searches with relevant keywords from Open AI's GPT. Note that, when using AI Boost, your search is sent to an external service, so don't enter any sensitive data.

You can search for detections in three available repositories. Select the corresponding button under the search bar. By default, the Platform Repos option is selected.

By default, content from all repositories of the selected type is displayed. If you want to see and search content only from specific repositories, choose them in the dropdown and click Apply.

You can search for and filter content in custom repositories the same way as the content published on TDM. Additionally, filtering will work only as long as corresponding metadata is present in the custom content.

Select a Search Profile from the dropdown menu to instantly get the results that match your company’s infrastructure, actual log sources, and relevant MITRE ATT&CK parameters.

If the profile has been marked as Default on Search on the Search Profiles page, when opening the Advanced Search, this profile will be automatically applied with its configured parameters.

If you don't wish to use any Search Profile, choose the None option. In case you have no Search Profiles configured yet, None is applied by default. Select Create New Profile in the dropdown menu to create a new Search Profile or select a pencil icon to edit the profile's settings. To learn more, see the Search Profiles section.

By default, the Recommended sorting is applied. Sigma rules are ranked based on our recommendation algorithms that boost the most up-to-date and high-quality content relevant to other cybersecurity experts.

You can apply other sorting options:

Additionally, you can switch between descending (most relevant first) and ascending (least relevant first) order by clicking the green arrow by the selected sorting option name.

With filters, you can narrow down the search results to see only what is relevant to your organization.

By default, the Filter Panel is expanded. To hide it, click the Hide Filters icon.

To show the panel again, click the Show Filters icon.

To add more filters, click More Expert Filters at the bottom left corner and set the checkbox next to the filter you'd like to use.

The selected filter will appear on the Filter Panel. To remove a filter from the panel, click More Expert Filters and clear the checkbox next to the filter.

When you select filters for a detection search, you can save the selected filter set as a Search Profile. This allows you to reuse the same filters in future searches by applying the saved Search Profile.

To save the filters as a Search Profile:

Note: The Content Availability filter is applied only to the current search and is not saved as a Search Profile.

After saving filters as a Search Profile, you can select this profile from the Search Profile dropdown on the left. To edit the profile, click the pencil icon in the dropdown.

To learn more about Search Profile, go to this article.

Enable this filter to search for content based on your professional role and security solution specified in your account settings or during the onboarding.

Click the Gear icon to edit your Role and Platform settings. To learn more about setting up this filter, see the Role and Platform section.

Apply this filter to see content with a particular availability status. Note: this filter is not relevant for Old Model Enterprise plans.

Note: This filter can be applied only when searching for the detections in Platform Repos.

Filter the detections by the way they’ve been created:

Note: This filter can be applied only when searching for the detections in Platform Repos.

Use this filter to see only those Sigma rules that have translations for your security platform or are translated into a specific native format you need.

When you may need this filter:

Use this filter to find popular content in your industry. This filter shows content that organizations in the selected industry have actively utilized during the last month.

Note: This filter can be applied only when searching for the detections in Platform and Community Repos.

Each Sigma rule requires specific logs to query against. Choose products from which you collect log data to see the rules with matching data requirements.

Alternatively, advanced users well-acquainted with the Sigma language can configure more generic filtering by required log sources using the Sigma Product, Sigma Service, and Sigma Category filters.

Search for content created by a particular author specified in the author field of a Sigma rule as per the DRL license.

Virtually all Sigma rules in the TDM are mapped to the MITRE ATT&CK framework. Filter by specific actors, tools, techniques, and sub-techniques you prioritize to see relevant Sigma rules.

Define your use case to find the most relevant detection content. Each content item has one or multiple icons next to its title to indicate what use case it is.

Enable this filter to show the content that has been hidden in Search results by your team. Once the filter is enabled, you can also set the checkmark Only hidden to show only those rules that were hidden in Search results.

Note: This filter can be applied only when searching for the detections in Platform Repos.

This filter is applicable for content that was run through the bulk translation flow and shows the results of the automatic bulk translations of content in a custom repository.

Filter for content to detect adversary activity within a particular cloud platform.

Select the type of content you want to search for:

Note:

Filter content by actions your organization has taken on it before. There are four action states available now:

Use the Include/Exclude toggle to show or filter out the desired state.

Enable this filter to show only the content excluded from the Attack detective scans.

Severity content search filter describes the criticality of the triggered detection rule. The following Severity options are available:

Sigma rules fall into one of the following three categories:

Filter Sigma rules by their status:

A Sigma log source identifier to select all log outputs of a certain product, for example, Linux, Windows, Cisco, etc. Learn more in Sigma specification.

A Sigma log source identifier to select only a subset of a product's logs, for example, sysmon, ldapd, dhcp. Learn more in Sigma specification.

A Sigma log source identifier to select all log files written by a certain group of products, for example, process_creation, file_access, etc. Learn more in Sigma specification.

Select one or multiple MITRE ATT&CK tactics to filter content covering them.

Select one or multiple MITRE ATT&CK data sources to filter content by items based on the corresponding logs like PowerShell logs, authentication logs, etc.

Select one or multiple MITRE ATT&CK data components to filter content by items based on these logs like Application Log Content, Certificate Registration, etc.

Select one or multiple CVE IDs the rules are related to.

Filter for content to detect adversary activity within a particular platform.

Each rule tile in your search results provides key details about the rule/query. Hover over a tile to see additional information or click it to go to the Detection Rule page and find the description of attributes there.

On the right, depending on the rule’s action state, you can view the following icons: Viewed, Downloaded, Downloaded via API, or Deployed.

The rule's availability is shown under its name by a special label:

You can find the description of all other attributes on the Detection Rule page.

You can hide a given rule in the Search results for your entire team. To hide a rule, on the Search page, click the eye icon on the rule’s tile.

Alternatively, you can hide a rule on the Detection Rule page by clicking three dots and selecting Hide in search Results.

To learn how to hide multiple rules using bulk action, go to this section.

Once the rule is hidden, the icon changes its state. Click it again to unhide the rule.

Tip: To see both hidden and non-hidden rules in the results, enable the Show hidden filter (If it isn't displayed in the filters panel, click More Expert Filters and set a checkmark next to this filter.) Once the filter is enabled, you can also set the checkmark Only hidden to show only those rules that were hidden in Search results.

Note: Hiding a rule from Search results does not affect any analytics. For example, if a hidden rule has been marked as deployed, it will be included as deployed in MITRE ATT&CK® Coverage and Log Source Coverage.

You can quickly hunt for the latest threats in your SIEM, EDR, or Data Lake.

Once you've deployed a rule, you can mark it as deployed right on the Detection rule page (change its Action State to Deployed). Marking a rule as deployed is important for it to be included in your organization's insights.

If you click the icon for a rule that has been marked as deployed manually or automatically (after deployment via Automation), all platforms will be marked as undeployed (both platforms manually marked as deployed before and platforms into which the rule was deployed via Automation).

You can also individually mark a separate translation as deployed on the Detection Code tab:

Alternatively, you can mark rules as deployed using bulk action on the Search page. Follow this section to learn more.

Threat intelligence and metadata for Sigma rules together with all their translations are always available to help you in your research. The code of some Sigma rules is also available for free. Such free rules are marked with the following labels:

However, most rules are offered as Premium. To access a Premium Sigma rule's code, you need to unlock it using your Premium Sigma rule balance.

All users that belong to the same organization have a shared Premium Sigma rule balance and access to the unlocked rules. When one user from the organization unlocks a rule, it becomes available to all the others.

Under the Enterprise plans, a preset balance of Premium Sigma rules is included into the subscription.

Note that when a Sigma rule is released, you can unlock it only after a certain waiting time:

While unavailable, the Sigma rule has the Wait to Unlock status.

The Premium Sigma rule balance is decreased by one each time you unlock a Premium Sigma rule.

To unlock a Premium Sigma rule, open the Code tab on the rule's page. When you unlock a rule for the first time, you can see a prompt for confirmation. After the first time, rules will be unlocked automatically without extra confirmation.

When the rule is unlocked, a popup appears under the balance counter.

After unlocking, you instantly get full access to the Sigma rule and all its translations. The access status of the rule changes to Unlocked.

Note:

You can check all the rules you've unlocked using the Unlocked option of the Content Availability filter.

You can select specific Sigma rules with checkmarks and perform bulk actions on the selected rules:

Notes:

You can add multiple rules to one or multiple Static Lists.

Note that this bulk action is applied only to those selected content items that are available to you (with such statuses as Unlocked, Promo, Free Access). Unavailable content is skipped.

You can copy any Sigma rule or its translation available to you on TDM to your custom repository. This action is referred to as forking.

When you fork a content item, its metadata is also copied. When you fork a translation of a Sigma rule, the original Sigma rule is copied together with the translation.

Note: This bulk action is applied only to those selected content items that are available to you (with such statuses as Unlocked, Promo, Free Access). Unavailable content is skipped.

You can hide the selected rules in the Search results for your entire team. This action is applicable only for content from Platform Repository.

Note that this bulk action is applied only to those selected content items to which it is applicable. The logic is as follows:

Learn more about alternative options for hiding rules in this section.

Once you've deployed rules, you can mark them as deployed (change their Action State to Deployed). To do it:

Note that this bulk action is applied only to those selected content items to which it is applicable. The logic is as follows:

Learn more about alternative options for marking rules as deployed in this section.

You can translate multiple rules at once using the Translate To option. This option is applicable only for the content from Custom Repositories.

You can delete multiple rules at once from your Custom Repository.

Follow the Detection Rule Page guide to learn more about the rule and the related threat.