## Building Detection-as-Code (DaC)

The old way: Click "Create Rule" in the GUI. Type stuff. Save.
The new way: Rules are logic. Logic is Code.

### Why Code?
1.  **Version Control (Git)**:
    *   "Who changed the Ransomware rule yesterday?" -> Check Git Commit History.
    *   "The new rule broke the SIEM." -> `git revert`.
2.  **Testing (CI/CD)**:
    *   Before deploying a rule to Production, run it in a pipeline against a test dataset.
    *   "Does this rule trigger on this sample `malware.evtx`?" (Unit Test).

### Sigma: The Standard Format
**Sigma** is a generic signature format for SIEMs (like Snort is for IDS). It is written in YAML.

```yaml
title: Suspicious PowerShell Download
status: experimental
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains:
            - 'Net.WebClient'
            - 'DownloadString'
    condition: selection
level: high
```

### The Workflow
1.  Analyst writes triggers in Sigma (YAML).
2.  Commits to GitHub.
3.  **Sigmac** (Compiler) converts the YAML into:
    *   Splunk SPL (`index=windows EventID=4104 ...`)
    *   Elastic Query (Lucene)
    *   Azure Sentinel (KQL)
4.  Automation pushes the query to the SIEM API.