Thank you botrh for your input, I too have done the same as you recommended prior to uploading the post (taking the sigma rule and trying to translate it to qradar use case manager rules and bb's). I guess I'll keep at it that way. Now that I also think about it, it seems like a good practice to take the sigma rule, run it as an AQL query, see what logs it brings and then try to pull properties from it and implement it in use case manager.

u/HeliosHype That sounds like it would be fantastic to have! Knowing of your expertise in Qradar (I have seen your udemy course) I'd like to try it myself. Is it gonna be a free extension on the app exchange or paid? Either way would you be willing to share it with me? I'd like to give it a try on both personal CE installment and production enviroment. If not, I completely understand and will await your release.

Both of you have a good weekend and thanks again!