pySigma Community Pipelines

Welcome to the pySigma Community Pipelines repository, the central hub for community-shared processing pipelines.

What are Processing Pipelines?

Processing pipelines provide granular control over how Sigma rules are converted into SIEM-specific formats. They enable among other things:

• Field Mappings - Convert generic field names to platform-specific equivalents (e.g., CommandLine → process.command_line for ECS, or process for Splunk)
• Log Source Mappings - Map Sigma log sources to data source identifiers (e.g., category: process_creation → winlog.channel: Microsoft-Windows-Sysmon/Operational)
• Value Transformations - Adjust field values for platform requirements (e.g., converting boolean values, handling data types)
• Conditional Logic - Add platform-specific search conditions (e.g., index names, source types)

🗂️ Repository Structure

The repository is organized by platform type:

• elastic_pipelines/ - Pipelines for Elastic Stack / ECS (Elasticsearch, Kibana, ElastAlert).
• splunk_pipelines/ - Pipelines for Splunk SIEM and Splunk Enterprise Security.
• pipeline_examples/ - Comprehensive examples demonstrating all transformation types currently supported by pySigma.

🚀 Usage

Using Sigma CLI

Convert Sigma rules using pipelines with sigma-cli:

sigma convert -t splunk -p splunk_pipelines/splunk_sysmon.yml rules/windows/process_creation/

🔎 Contributing

We welcome contributions of new pipelines and improvements to existing ones!

This repository thrives on community involvement to expand the collection of processing pipelines for various security platforms.

How to Contribute

1. Fork the repository and create a feature branch
2. Create or modify pipelines in the appropriate directory
3. Test your pipeline with example Sigma rules
4. Document your changes
5. Submit a pull request with a clear description

Related Projects

• Sigma Rules - Main Sigma detection rule repository
• pySigma - Core Python library for Sigma rule processing
• sigma-cli - Command-line tool for Sigma rule conversion

📜 Maintainers

• Nasreddine Bencherchali (@nas_bench)