pySigma-backend-elasticsearch 1.1.0

pySigma Elasticsearch backend supportinhg Lucene, ES|QL (with correlations) and EQL queries

pySigma Elasticsearch Backend

This is the Elasticsearch backend for pySigma. It provides the package sigma.backends.elasticsearch with the LuceneBackend class.

It supports the following output formats:

• default: Lucene queries.
• dsl_lucene: DSL with embedded Lucene queries.
• eql: Elastic Event Query Language queries.
• kibana_ndjson: Kibana NDJSON with Lucene queries.

Further, it contains the following processing pipelines in sigma.pipelines.elasticsearch:

• ecs_windows in windows submodule: ECS mapping for Windows event logs ingested with Winlogbeat.
• ecs_windows_old in windows submodule: ECS mapping for Windows event logs ingested with Winlogbeat <= 6.x.
• ecs_zeek_beats in zeek submodule: Zeek ECS mapping from Elastic.
• ecs_zeek_corelight in zeek submodule: Zeek ECS mapping from Corelight.
• zeek_raw in zeek submodule: Zeek raw JSON log field naming.

This backend is currently maintained by:

• Thomas Patzke
• Hendrik Bäcker

Further maintainers required! Send a message to Thomas if you want to co-maintain this backend.