Sigma rules are the standard choice: vendor-agnostic YAML patterns that pySigma or the sigmac converter can transpile to SQL for execution against Parquet data in the lake. The workflow is to normalize logs to OCSF at ingestion, convert Sigma rules to SQL, and schedule those queries as batch or streaming jobs. Platforms like Panther and Google Chronicle also support data lake storage as a detection backend natively.