pysigma-backend-splunk
pySigma Splunk backend
Decision gist · record as of 2026-08-14
Yes, if you use Sigma rules and deploy to Splunk. The package is actively maintained, has low install friction, and fills a clear gap in the workflow. The copyleft LGPL-2.1-only license is standard for the Sigma ecosystem; verify it aligns with your distribution model. No known vulnerabilities.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later; pysigma must be installed.
- Low friction install with a single runtime dependency (pysigma).
- Repository is active with recent commits, though the package itself sees infrequent releases.
License · maintenance · safety
LGPL-2.1-only (copyleft) — Licensed under LGPL-2.1-only (copyleft). Derivative works and modifications must be released under the same license; proprietary use requires careful review of your distribution model.
last release 2026-03-22 (145 days) · last repo commit 2026-03-22 · 44 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 114,386 downloads/mo, #12,296 on PyPI
Alternatives
Verify before relying
pip install pysigma-backend-splunk
from sigma.backends.splunk import SplunkBackend
backend = SplunkBackend()
query = backend.convert_rule(rule)- Whether Windows log processing pipelines require Sysmon data or work with standard Windows Event Log sources
- Performance characteristics when translating large rule sets or complex detection rules
- Compatibility with specific Splunk versions beyond the Python version support range
What it is and what it does
pySigma Splunk Backend is a compiler that converts detection rules into native Splunk search queries. It acts as a bridge between the Sigma ecosystem and Splunk, allowing security teams to author detections once and deploy them to Splunk without manual translation.
The package provides processing pipelines for Windows log detection and Sysmon acceleration, plus support for multiple output formats (plain queries and savedsearches.conf). It depends solely on pysigma and supports Python 3.10 through 3.14. The repository is actively maintained with no known security vulnerabilities.
Use it for
- Convert detection rules to Splunk queries for automated deployment in security operations centers
- Generate Splunk savedsearches.conf files from rules for scheduled detection workflows
- Accelerate Splunk searches on Windows logs using Sysmon keyword optimization
- Integrate rule libraries into Splunk environments without manual query rewriting
- Build detection-as-code pipelines that translate security logic across SIEM platforms
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you use Sigma rules and deploy to Splunk.
The package is actively maintained, has low install friction, and fills a clear gap in the workflow. The copyleft LGPL-2.1-only license is standard for the Sigma ecosystem; verify it aligns with your distribution model. No known vulnerabilities.
Install
pysigma-backend-splunk on PyPI
Before you install
Low friction install with a single runtime dependency (pysigma). Repository is active with recent commits, though the package itself sees infrequent releases.
Requires Python 3.10 or later; pysigma must be installed.
License in practice
Licensed under LGPL-2.1-only (copyleft). Derivative works and modifications must be released under the same license; proprietary use requires careful review of your distribution model.
Quickstart
pip install pysigma-backend-splunk
from sigma.backends.splunk import SplunkBackend
backend = SplunkBackend()
query = backend.convert_rule(rule)Verify before relying
- Whether Windows log processing pipelines require Sysmon data or work with standard Windows Event Log sources
- Performance characteristics when translating large rule sets or complex detection rules
- Compatibility with specific Splunk versions beyond the Python version support range
Package facts
| License | LGPL-2.1-only copyleft |
| Python support | Supports the current Python release <4.0,>=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagepysigma |
| Maintenance | Actively maintained 145 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 114,386 / month, #12,296 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI ApprovedProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14 |
Evidence: pysigma_backend_splunk-2.1.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “sigma to splunk query translation”
- pysigma-backend-splunkTranslates Sigma detection rules into Splunk search queries,…
- pySigmaParses and converts Sigma detection rules into queries for various…
- pySigma-backend-elasticsearchTranslates Sigma security rules into Elasticsearch query formats…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also pySigma · pySigma-backend-elasticsearch · sigmatools · splunk-sdk · splunk-handler · signalflow-client-python · splunk-hec-handler · snaptime · signalfx · aws-sam-cli