Shopee Interview Question

How would you write a SIEM detection rule for sql injection