---
id: pysigma-backend-elasticsearch
version: "2.1.1"
license: LGPL-3.0-only
license_treatment: copyleft
maintenance: active
---

# pySigma-backend-elasticsearch — pySigma Elasticsearch backend supporting Lucene, ES|QL (with correlations) and EQL queries

License: copyleft · Maintenance: active · Downloads: 111.8K/mo

## What it is and what it does

This is a backend plugin for pySigma that converts Sigma detection rules into query formats compatible with Elasticsearch and Kibana. It provides multiple output formats—Lucene queries (the default), DSL with embedded Lucene, EQL (Elastic Event Query Language), and Kibana NDJSON—allowing security teams to deploy the same rule logic across different Elasticsearch environments. The package includes processing pipelines that map generic Sigma field names to environment-specific schemas: ECS mappings for Windows events via Winlogbeat, Zeek logs from both Elastic and Corelight, Kubernetes audit logs, and macOS Endpoint Security Framework events. This bridges the gap between rule authoring and operational deployment.

The backend is actively maintained and supports query post-processing via custom YAML pipelines, enabling teams to customize output formats beyond the built-in options. The package depends only on pysigma and supports Python 3.10–3.14.

Use it for:

- Convert Sigma rules to Lucene queries for deployment in existing Elasticsearch SIEM environments.
- Generate EQL queries for Elastic's event correlation and threat hunting workflows.
- Export Sigma rules as Kibana NDJSON saved searches or SIEM detection rules for import.
- Map Windows event logs ingested via Winlogbeat to Sigma rule field names using ECS pipelines.
- Translate Zeek network logs to Elasticsearch queries using Elastic or Corelight ECS mappings.
- Customize rule output format via query post-processing pipelines for organization-specific requirements.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Translates Sigma security rules into Elasticsearch query formats including Lucene, EQL, and Kibana NDJSON, with processing pipelines for Windows, Zeek, Kubernetes, and macOS event log mappings.

Yes. This is a well-maintained, actively released backend with low install friction and no known vulnerabilities. Install it if you author or deploy Sigma rules and need to run them against Elasticsearch. The copyleft license (LGPL-3.0-only) is standard for this ecosystem and poses no barrier to use; it only affects redistribution of modified source code.

## Install

pip install pysigma-backend-elasticsearch
uv add pysigma-backend-elasticsearch
poetry add pysigma-backend-elasticsearch

## Installing pySigma-backend-elasticsearch

Before you install: Low friction install with a single runtime dependency (pysigma). Actively maintained with a release 4 days ago, supporting Python 3.10–3.14.

License in practice: Licensed under LGPL-3.0-only (copyleft). Derivative works and distributions must provide source code access and maintain the same license.

Quickstart:

pip install pysigma-backend-elasticsearch

from sigma.backends.elasticsearch import LuceneBackend
backend = LuceneBackend()
query = backend.convert_rule(rule)

Requires Python 3.10 or later (requires_python: >=3.10,<4.0). The pysigma runtime dependency must be installed.

Verify before relying:

- Whether the backend supports all Sigma rule types or has known limitations with specific rule constructs.
- Performance characteristics when converting large rule sets or complex nested conditions.
- Compatibility guarantees with specific Elasticsearch and Kibana versions.

## Package facts

- License: LGPL-3.0-only (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 111.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

sigma to elasticsearch query translation, lucene query generator from sigma rules, eql query backend, kibana ndjson export, security rule conversion elasticsearch, windows event log ecs mapping, zeek log elasticsearch backend, sigma-rules, elasticsearch-backend, threat-detection

[View on SkillFed](https://skillfed.io/packages/pysigma-backend-elasticsearch) · [View on PyPI](https://pypi.org/project/pysigma-backend-elasticsearch/)