Import signed packs of curated Sigma rules and install their rules as org detections — installing is an Enterprise feature, which is in development.
What it is
Settings → Content packs (/settings/content-packs, admin only) holds curated Sigma rule packs signed by Talon Labs. A pack is one JSON envelope: a manifest of rules — each with its Sigma, ATT&CK technique, confidence and false-positive notes — and an Ed25519 signature over it, checked against a public key built into the image. Packs are version-tracked, and each is listed with its rules; installing a rule makes it an org detection.
Importing a pack
Upload pack takes a signed envelope (.json). A tampered or unsigned file is rejected before anything reaches the database, and so is a version no newer than the one already imported.
Check feed fetches the latest signed pack from the URL in CONTENT_PACK_FEED_URL and imports it the same way, or says the feed is up to date. Without that variable the button is disabled. It runs only when you press it; nothing polls the feed.
Each pack shows its id, version, rule count, when it was imported and how (upload or feed), and each rule its id, ATT&CK technique and confidence.
Import a signed pack, with Check feed and Upload pack, and the note that installing a pack's rules needs an Enterprise key. Imported packs are listed below it, each rule with an Install button.
Installing rules
Install on a rule creates an org detection from it, recording the pack version it came from, and writes it to Org/detections/ in the org config repo. Each rule installs once per organisation; installing it again is refused.
Community Edition
Installing rules from a pack needs an Enterprise key, and Enterprise is in development. On the Community Edition the page says so and the Install buttons are disabled; you can still import and preview packs.
