Shopee interview question

How would you write a SIEM detection rule for sql injection