Threat detection with Sysmon .csv log using Sigma Rules

I’m not sure whether my approach is completely wrong, so please let me know if it is.

Threat detection from Sysmon .csv log using Sigma Rules?

I’m not sure whether my approach is completely wrong, so please let me know if it is.

Threat detection from Sysmon .csv log using Sigma Rules?

I’m not sure whether my approach is completely wrong, so please let me know if it is.