MagnetForensics / sigma-convert

Convert Sigma Rules to different formats

SIGMA CONVERT

This project draws inspiration from SigmaHQ for the opensource Sigma Rules. Sigma Convert can convert Sigma Rules to the following destination types. It can convert a single sigma rule file or a folder of sigma rule files. There is also an API Server available, so you can run an API Server to do conversions using Microservices.

Test it

Convertor: https://www.sigmac.to
API Docs: https://www.sigmac.to/docs

Supported Conversions.

The currently supported backends are:

• ElastAlert
• HumioAlert
• Kibana
• Qradar
• Splunk
• ArcSight
• Chronicle
• Devo
• LogRhythm
• KafkaSQL
• AWS OpenSearch
• DNIF
• GrayLog
• SQL
• SQLite
• Secronix
• Sentinel
• Snowflake
• Sumo Logic

Help

$ ./sigmac --help
This is the Sigma command line interface to convert Sigma rules into query languages.

Usage: sigmac [OPTIONS] --dest-type <DEST_TYPE>

Options:
  -s, --source-type <SOURCE_TYPE>
          The source target to convert from [default: sigma]
  -t, --dest-type <DEST_TYPE>
          The target type to convert to, could be arcsight, quradar, elastalert
  -f, --file-source <FILE_SOURCE>
          The source file to convert
  -d, --dir-source <DIR_SOURCE>
          The source dir to recursively convert
  -m, --mappings-file <MAPPINGS_FILE>
          The mappings.txt file for the current backend
      --keep-fields <KEEP_FIELDS>
          Keep the following list of fields in the sigma rule(comma separated). Eg "title, author, tags". `Note: This only applies to the ElastAlert dest_type`
      --replace-fields <REPLACE_FIELDS>
          Replace the following list of K:V fields in the elastalert rule (comma separated). Eg "index: tid1452-*". `Note: This only applies to the ElastAlert dest_type`
      --add-alerting <ADD_ALERTING>
          Add an alerting mode to the list in the elastalert rule. `Note: This only applies to the ElastAlert dest_type`
      --add-fields <ADD_FIELDS>
          Add extra fields in the elastalert rule if required. `Note: This only applies to the ElastAlert dest_type`
  -h, --help
          Print help
  -V, --version
          Print version

Example Usage

• Convert a simple Sigma Rule to ElastAlert

$ ./sigmac --source-type sigma --dest-type elastalert --file-source ../sigmarules/T1089-\ Defense\ evasion\ \ -\ Disabling\ Security\ Tools.yml 
Converting the sigma rule in ../sigmarules/T1089- Defense evasion  - Disabling Security Tools.yml...
SUCCESS: Converted the sigma rule in ../sigmarules/T1089- Defense evasion  - Disabling Security Tools.yml to elastalert.

Output File: "~/Documents/output/elastalert_T1089- Defense evasion  - Disabling Security Tools.yml"

• Convert a simple Sigma Rule to ElastAlert and keep certain fields in the ElastAlert output

$ ./sigmac --dest-type elastalert --file-source ../sigmarules/T1089-\ Defense\ evasion\ \ -\ Disabling\ Security\ Tools.yml --keep-fields name,tags,impact

• Convert a simple Sigma Rule to ElastAlert and change/replace field values

$ ./sigmac --source-type sigma --dest-type elastalert --file-source ../sigmarules/T1089-\ Defense\ evasion\ \ -\ Disabling\ Security\ Tools.yml --replace-fields "index: newindex*"

• Convert a simple Sigma Rule to ElastAlert and add new fields

$ ./sigmac --dest-type elastalert --file-source ../sigmarules/T1089-\ Defense\ evasion\ \ -\ Disabling\ Security\ Tools.yml --add-fields "xyz=new_field1, abc=new_field2"

• Convert a simple Sigma Rule to ElastAlert and add new alerting other than debug

$ ./sigmac --dest-type elastalert --file-source ../sigmarules/T1089-\ Defense\ evasion\ \ -\ Disabling\ Security\ Tools.yml --add-alerting "Some.New.Alerting"

• Convert a simple Sigma Rule to a destination along with Field Mapping file. Use-case Scenario: Typically, Sigma Rule YML Files are defaulted with assumed keys. Here you can pass a field mapping file so that you can replace the default keys to match the keys for your environment.

$ ./sigmac  --source-type <SOURCE_TYPE> --dest-type <DEST-TYPE> --file-source <FILE> --mappings_file <MAPPINGS-FILE>

• Convert a batch of Sigma files from a folder to ElastAlert

$ ./sigmac --source-type sigma --dest-type elastalert --dir-source ../sigmarules 

Authors

Sriram [e-mail]

License

• MIT