Sigma Backends

Sigma backends are the "drivers" of the Sigma conversion process, and implements the conversion capability that converts each Sigma rule file into a SIEM compatible query.

The newly developed pySigma framework provides an API for each Sigma backend to perform conversion, transformation and formatting of every Sigma rules.

Conversion Diagram - showing the conversion from Sigma Rule Files (top) through pySigma, and down to the final stage where the rule files have been converted to string SIEM queries

Developing a backend for the Sigma ecosystem

If developing a pySigma backend interests you in bringing Sigma support your SIEM language, first ensure one isn't already available on GitHub.

Still the best guide on how to create a pySigma compatible backend is Micah Babinski's Blog Post on Creating a Sigma Backend for Fun (and no Profit). We're working hard on writing an official guide for this, but until then, a big thank you to Micah for writing this guide.

Working with Backends

To investigate available pySigma backends that you can use, ensure you have the sigma-cli tool installed, then run the following commands to view all available backends in a table.

bash

sigma plugin list -t backend

+----------------------+---------+---------+--------------------------------------------------------------+
| Identifier           | Type    | State   | Description                                                  |
+----------------------+---------+---------+--------------------------------------------------------------+
| splunk               | backend | stable  | Splunk backend for conversion into SPL and tstats data model |
| insightidr           | backend | stable  | Rapid7 InsightIDR backend that generates LEQL queries.       |
| qradar               | backend | stable  | IBM QRadar backend for conversion into AQL and extension     |
| ...                  | ...     | ...     | ...                                                          |
+----------------------+---------+---------+--------------------------------------------------------------+

Once you've found the Sigma backend you want to use, you can install it using the sigma plugin install command.

bash

sigma plugin install splunk

If you for whatever reason need to remove a Sigma plugin, you can also uninstall it using the same method.

bash

sigma plugin uninstall splunk

Components

The sigma CLI (powered by pySigma) also allows backends to do more with their conversion process, including providing added output formats, such as Splunk Saved Search format for the Splunk pySigma backend.

For every backend, there exist 4 components – that perform or aid the conversion process.

Targets
Pipelines
Output Formats
Validators

Targets

Targets represent the type of query language you want to output the Sigma format in. This will usually be mapped one-to-one with every SIEM product.

bash

# List all locally available Sigma backends
sigma list targets

Make sure to install plugins

If you're not seeing any available targets, make sure you install the relevant Sigma plugin for your target SIEM. For a full list of installable backends, click here to view all Available Backends.

bash

# List available Sigma plugins
sigma plugin list

# Install the desired plugin
sigma plugin install {plugin}

Output Formats

To explore Output Formats in more detail, start by listing the available Output Formats by running the following command:

bash

sigma list formats {backend}

+---------------+----------------------------------------+
| Format        | Description                            |
+---------------+----------------------------------------+
| default       | Plain SIEM Queries                     |
| file_format   | Plain SIEM Queries in file_format.conf |
| macro_exam    | Completely different SIEM Format       |
+---------------+----------------------------------------+

Once you've found which output format works best for your conversion workflows, you can invoke it over the command line like so.

bash

sigma convert -t {target} -f {output_format} ./rules

Pipelines

WIP

Pipelines are the method by which pySigma allows fine-tuning to be applied to conversion. This documentation outlines what pipelines are, and how to use them in more detail over on the Pipelines documentation page.

Pipelines control things like field-mapping (mapping Sigma fields, to fields within your SIEM), logsource mapping (mapping Sigma logsources to logsources in your SIEM) & other operations.

To view all available pipelines – that are provided specifically by the backend, you can run sigma list pipelines.

bash

sigma list pipelines

You can specify multiple pipelines when converting Sigma rules, to perform more than one operation on

Available Plugin

Below is a list of available Sigma Backends and Pipelines. If you come across any issues using any specific Sigma plugin, file an issue on the relevant Sigma Plugin's project page.

Plugin Type:

Azure Log Analytics Socprime

Development

Azure Log Analytics backend with Windows log support maintained by SOC Prime.

Sigma Backends ​

Working with Backends ​

Components ​

Targets ​

Output Formats ​

Pipelines ​

Available Plugin ​

Azure Log Analytics Socprime

CarbonBlack

CortexXDR

Datadog

Dictquery

Elasticsearch

Hawk

IBM QRadar AQL

InsightIDR

Loki

Microsoft 365 Defender

OpenSearch

Panther

PowerShell

QRadar

SentinelOne

SentinelOne PowerQuery

Splunk

Sqlite

Stix

Trellix Helix

Uberagent

Sigma Backends

Working with Backends

Components

Targets

Output Formats

Pipelines

Available Plugin