pySigma Sumo Logic Backend

Overview

A pySigma backend that converts Sigma detection rules into Sumo Logic Cloud SIEM rule JSON, ready for import via the CSE API. Includes field mappings for 70+ log sources, automatic entity selector assignment, MITRE ATT&CK tag mapping, and confidence scoring.

Quick Start

pip install sigma-cli pysigma-backend-sumologic
sigma convert -t sumologic_cse_rule -p sumologic_cse rule.yml

Supported Log Sources

Full Field Mapping

These log sources have Sigma fields automatically renamed to CSE normalized schema fields:

Metadata-Only (Vendor/Product Tagging)

These log sources get metadata_vendor and metadata_product injected into the query. Fields pass through as fields['FieldName'] in CSE syntax:

• Windows (30+ services): powershell-classic, taskscheduler, WMI, DNS-server, windefend, driver-framework, etc.
• AWS: S3, GuardDuty, VPC, WAF, Route53, Config, EKS, ELB, CloudWatch, SecurityHub, etc.
• Azure: Sign-in Logs, Audit Logs, Firewall, Risk Detection, PIM, etc.
• GCP: Audit, GCE, GCS, BigQuery, Security Center
• Google Workspace: Admin, Login
• Cisco: ASA, Firepower, ISE, Umbrella, Meraki, Duo, AnyConnect, etc.
• Palo Alto Networks: Threat, Traffic, Cortex, GlobalProtect, Prisma Cloud, etc.
• Fortinet: FortiGate, FortiClient
• Other: Okta, OneLogin, GitHub, Kubernetes, Check Point, Zeek, Exchange

Output Format

Produces complete CSE rule JSON ready for the Rules API:

{
  "rules": [
    {
      "name": "Suspicious PowerShell Execution",
      "expression": "commandLine matches /.*powershell -enc.*/",
      "entity_selectors": [
        {"entity_type": "_hostname", "expression": "device_hostname"},
        {"entity_type": "_username", "expression": "user_username"},
        {"entity_type": "_process", "expression": "baseImage"}
      ],
      "score_mapping": {"default": 6, "type": "constant"},
      "tags": ["_mitreAttackTactic:TA0002", "_mitreAttackTechnique:T1059"],
      "category": "Execution",
      "enabled": true,
      "is_prototype": true,
      "mapping_confidence": {"overall_score": 0.691, "...": "..."}
    }
  ]
}

How It Works

Field Mapping — The sumologic_cse pipeline renames Sigma standard fields to CSE normalized schema fields based on the rule's log source category.

Confidence Scoring — Each field mapping receives a confidence score (0–1). If the lowest score falls below the threshold (default: 0.25), conversion is blocked with a message showing exactly which fields failed and what threshold to use.

Entity Selectors — Automatically assigned based on log source category:

• Process rules → hostname + username + process
• Network/firewall rules → hostname + IP
• DNS rules → hostname + domain
• Authentication rules → hostname + IP + username
• File rules → hostname + file path

MITRE ATT&CK — Tags from Sigma rules are mapped to CSE format (attack.execution → _mitreAttackTactic:TA0002).

Severity — Sigma levels map to CSE scores: critical=8, high=6, medium=3, low=1, informational=1.

Unmapped Field Handling

Installation

From PyPI

pip install pysigma-backend-sumologic

From Source

git clone https://github.com/SumoLogic/pySigma-backend-sumologic
cd pySigma-backend-sumologic
pip install .

Usage

With sigma-cli

# Convert to CSE rule JSON
sigma convert -t sumologic_cse_rule -p sumologic_cse rule.yml

# Convert a directory of rules
sigma convert -t sumologic_cse_rule -p sumologic_cse ./rules/windows/

# Lower confidence threshold for more permissive conversion
sigma convert -t sumologic_cse_rule -p sumologic_cse -O min_confidence=0.0 rule.yml

As Python Library

from sigma.collection import SigmaCollection
from sigma.backends.sumologic import SumoLogicCSERuleBackend
from sigma.pipelines.sumologic import sumologic_cse_pipeline

pipeline = sumologic_cse_pipeline()
backend = SumoLogicCSERuleBackend(processing_pipeline=pipeline)

rule = SigmaCollection.from_yaml(open('rule.yml').read())
result = backend.convert(rule)
print(result[0])  # CSE rule JSON string

Configuration Options

Pass via -O key=value with sigma-cli or as constructor kwargs in Python:

Limitations

• Correlation rules — Not supported (Sigma correlation features)
• Data field arbitrary strings — Data|contains: 'Net.WebClient' cannot be converted (~12 Sigma rules affected). Structured patterns like Data|contains: 'EngineVersion=2.' are handled automatically.
• Keywords field — Not supported (CSE requires structured field-based queries)
• Complex regex — Limited support for advanced regex modifiers

Development

# Install dev dependencies
pip install -e ".[dev]"

# Run tests
pytest

# Run with coverage
pytest --cov=sigma --cov-report=term

Resources

• Sumo Logic Cloud SIEM Documentation
• Sigma Rule Specification
• pySigma Documentation
• sigma-cli

License

LGPL-3.0 — see LICENSE.