Oof, that reminds me of having a discussion with Rapid7 when we were SIEM searching.
At the time, their platform had bare-minimum built-in rules for macOS endpoints, so I figured we could just port them via Sigma - except they had some absurdly low limit like ~30 custom rules allowed.
I was told I could possibly get an exemption for ~70. Like, what in the actual fuck?
Thomas Strömberg
npub1mw…xvjjk
2026-06-09 21:40:16 UTC
in reply to nevent1q…th9h
Author Public Key
npub1mwgrtm0h3hnlfw9hvzqvhfchz9wzy2dvua0q6zr7lqwuxuu6hpms8xvjjkSeen on
wss://relay.momostr.pinkPublished at
2026-06-09 21:40:16 UTCEvent JSON
{
"id": "c597d2d262a10dd1013b41ce82bedb8c3c261deabd957f14654064471929499d",
"pubkey": "db9035edf78de7f4b8b76080cba717115c2229ace75e0d087ef81dc3739ab877",
"created_at": 1781041216,
"kind": 1,
"tags": [
[
"p",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"e",
"d4874accdfc480edc072ea154a3753c994f053bb1f4e9a080f579c2433500b0a",
"",
"root",
"86b397086a130510861dd58f255fadeee1c47815185fa3bb628a06b4d6af31ac"
],
[
"proxy",
"https://triangletoot.party/@thomrstrom/116722317137942035",
"web"
],
[
"proxy",
"https://triangletoot.party/users/thomrstrom/statuses/116722317137942035",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://triangletoot.party/users/thomrstrom/statuses/116722317137942035",
"pink.momostr"
],
[
"-"
]
],
"content": "Oof, that reminds me of having a discussion with Rapid7 when we were SIEM searching.\n\nAt the time, their platform had bare-minimum built-in rules for macOS endpoints, so I figured we could just port them via Sigma - except they had some absurdly low limit like ~30 custom rules allowed.\n\nI was told I could possibly get an exemption for ~70. Like, what in the actual fuck?",
"sig": "c6239bcd44c62376ec12f43d480615ec35e1755788876b58ed0a4fdab504282cca16f3d126c75bbeb4d40dfe37086ddb5f9c55b7bbac3ec19d49cca693d5d901"
}