pySigma-backend-elasticsearch

What it is and what it does

This is a backend plugin for pySigma that converts Sigma detection rules into query formats compatible with Elasticsearch and Kibana. It provides multiple output formats—Lucene queries (the default), DSL with embedded Lucene, EQL (Elastic Event Query Language), and Kibana NDJSON—allowing security teams to deploy the same rule logic across different Elasticsearch environments. The package includes processing pipelines that map generic Sigma field names to environment-specific schemas: ECS mappings for Windows events via Winlogbeat, Zeek logs from both Elastic and Corelight, Kubernetes audit logs, and macOS Endpoint Security Framework events. This bridges the gap between rule authoring and operational deployment.

The backend is actively maintained and supports query post-processing via custom YAML pipelines, enabling teams to customize output formats beyond the built-in options. The package depends only on pysigma and supports Python 3.10–3.14.

Use it for:

• Convert Sigma rules to Lucene queries for deployment in existing Elasticsearch SIEM environments.
• Generate EQL queries for Elastic's event correlation and threat hunting workflows.
• Export Sigma rules as Kibana NDJSON saved searches or SIEM detection rules for import.
• Map Windows event logs ingested via Winlogbeat to Sigma rule field names using ECS pipelines.
• Translate Zeek network logs to Elasticsearch queries using Elastic or Corelight ECS mappings.
• Customize rule output format via query post-processing pipelines for organization-specific requirements.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Translates Sigma security rules into Elasticsearch query formats including Lucene, EQL, and Kibana NDJSON, with processing pipelines for Windows, Zeek, Kubernetes, and macOS event log mappings.

Yes. This is a well-maintained, actively released backend with low install friction and no known vulnerabilities. Install it if you author or deploy Sigma rules and need to run them against Elasticsearch. The copyleft license (LGPL-3.0-only) is standard for this ecosystem and poses no barrier to use; it only affects redistribution of modified source code.

Install

pysigma-backend-elasticsearch on PyPI

pip install pysigma-backend-elasticsearch

uv add pysigma-backend-elasticsearch

poetry add pysigma-backend-elasticsearch

Installing pySigma-backend-elasticsearch

Before you install

Low friction install with a single runtime dependency (pysigma). Actively maintained with a release 4 days ago, supporting Python 3.10–3.14.

License in practice

Licensed under LGPL-3.0-only (copyleft). Derivative works and distributions must provide source code access and maintain the same license.

Quickstart

pip install pysigma-backend-elasticsearch

from sigma.backends.elasticsearch import LuceneBackend
backend = LuceneBackend()
query = backend.convert_rule(rule)

Requires Python 3.10 or later (requires_python: >=3.10,<4.0). The pysigma runtime dependency must be installed.

Verify before relying

• Whether the backend supports all Sigma rule types or has known limitations with specific rule constructs.
• Performance characteristics when converting large rule sets or complex nested conditions.
• Compatibility guarantees with specific Elasticsearch and Kibana versions.

Package facts

Evidence: pysigma_backend_elasticsearch-2.1.1-py3-none-any.whl

Tags

More Security packages