Draft a rule¶
Describe what to catch in plain words, or paste a Sigma rule. Chuka writes the search for your Splunk, using only indexes and data models you have. Run it on the last 7 days before saving. New rules are saved switched off, until someone reviews and enables them.
