Ian

The sigma language supports a value modifier called `expand` that allows dynamic, environment-specific values to be populated through a translation pipeline. See the blog.sigmahq.io writeup [here](https://blog.sigmahq.io/building-flexible-detections-with-sigma-placeholders-7c1b814e2860). When a sigma rule...

### Describe the bug The field in question is for Conditional Access Policies (`https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies`): `conditions.authenticationFlows.transferMethods`. When specified in a policy, the graph API returns this field as a comma-separated string,...