Building SIEM rules for 5G SBI traffic

Anatomy of a SIEM Detection Rule

A production SIEM detection rule has structure beyond just a query. Title and description: what the rule detects and why it matters. Severity: how serious the alert is (low/medium/high/critical) — affects analyst priority. Log source: which logs the rule applies to (NRF access logs, AMF access logs, NGAP logs, etc.). Detection logic: the actual query/expression matching the threat pattern. Reference links: FiGHT technique IDs, threat intel sources, internal threat model entries. Tags/metadata: FiGHT classification, affected products, related rule IDs. False-positive notes: known scenarios…