To identify the source of the detection, click on the detection details where you will be able to see the author field. It contains the identity (email or key name) of the entity that created the rule.

Detections that come in through a managed Sigma rule will have the author listed as _sigma.

Did this answer your question?