Add notes on sigma rule