r/crowdstrike•
rlgarey

Yaml Rules

General Question

Hey I have a quick question, we have an internal intelligence team who provides our SOC with yaml files. Our old SIEM could ingest these and create rules that searched as logs flowed in and would alert. Is there a way to do this? I've seen malquery but that seems to search Crowdstrikes intelligence and not our logs in the network.

Posted Jun 8, 2026, 4:37 PM UTC

86
Loading comments…