Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphony is in beta and still being built. How a rule earns its badge.

How it works The corpus Translate a rule Techniques Playbooks

Alert response · Collection / Exfiltration responders

Collection and exfiltration

Data being gathered or moved. This is where a security incident becomes a disclosure obligation.

This is where a security incident becomes a disclosure obligation. What the data was matters as much as how it left.

What this does not establish

Whether anything left. Staging is preparation, and often the last step you see.
What was in the archive. A file name is not an inventory.
Whether it is the only copy staged. Look for the others.

0 of 9 ticked

Flow width52%

Selected step

DetectStep 1 of 9

Identify what was collected and from where

Source paths name the data owner; the archive name does not.
Shares, mailboxes and databases each carry a different obligation.
Preserve the staged file before anything deletes it.
Start the timeline now: every action, who took it, when.
A misdirected email or a lost device is a loss too; same obligations, different response.
Look for other staging: the same archive name or tool on other hosts.

Tick this step

How to use this

Select a step to read its reasoning. Tick steps to track this browser’s progress. A decision can send you to a named owner or another step. A tick is a reading aid, not an incident status.

Related playbooks

Critical incident: standing up the response
Business email compromise
Insider data theft

Reference sources

This guide is Siemphony’s synthesis for a general workflow. Review the original guidance and your local procedure before using it operationally.

NIST SP 800-61 Rev. 3
MITRE ATT&CK detection and analytics

Siemphony

A detection-engineering studio for people moving from the SOC into detection work. Compose in Sigma, translate it, publish a repertoire anyone can open.

Less noise. More signal.

On this page

One source, four artifacts
The reference corpus
ATT&CK coverage
How verification works

Explore

Every ATT&CK technique
SOC playbooks
Translate a rule

Sources

MITRE ATT&CK
Sigma specification
SigmaHQ rule repository

Account

Log in
Sign up
Terms
Privacy

© 2026 Siemphony

Sigma is a community standard maintained by SigmaHQ. ATT&CK is a registered trademark of The MITRE Corporation. Siemphony is not affiliated with either, nor with Microsoft, Splunk, Elastic or Wazuh.