Sigma Backends

Sigma Backends

Two tools for working with Sigma rules after authoring:

• sigma-cli (Python/pySigma): converts rules into backend-specific queries (SPL, Lucene, KQL, etc.) for import into a SIEM
• rsigma (Rust): evaluates rules directly against JSON log events in real time -- no SIEM required

Both support processing pipelines for field name mapping between generic Sigma fields and backend-specific schemas.

---

sigma-cli Quick Start

Install

pip install sigma-cli

Install a Backend Plugin

sigma plugin install splunk

Convert Rules

sigma convert -t splunk -p sysmon rules/windows/process_creation/
sigma convert -t elasticsearch -p ecs_windows -f kibana_ndjson rules/
sigma convert -t kusto -p sentinel_asim rules/

List Available Backends, Formats, and Pipelines

sigma plugin list -t backend     # all available backend plugins
sigma list targets               # locally installed backends
sigma list formats splunk        # output formats for a backend
sigma list pipelines             # available processing pipelines

Check Rules

sigma check rules/               # validate rule syntax

For the full sigma-cli command reference, see references/sigma-cli.md.

---

rsigma Quick Start

Install

cargo install rsigma

Evaluate Events

# Single event (inline JSON)
rsigma eval -r rules/ -e '{"CommandLine": "cmd /c whoami"}'

# Stream NDJSON from stdin
cat events.ndjson | rsigma eval -r rules/

# With a processing pipeline
rsigma eval -r rules/ -p ecs.yml -e '{"process.command_line": "whoami"}'

# Read events from a file
rsigma eval -r rules/ -e @events.ndjson

Lint Rules

rsigma lint rules/                        # 65 built-in lint rules
rsigma lint rules/ --fix                  # auto-fix 13 safe rules
rsigma lint rules/ --schema default       # + JSON schema validation
rsigma lint rules/ --disable missing_description,missing_author

Validate Rules

rsigma validate rules/ -v                 # verbose validation
rsigma validate rules/ -p ecs.yml         # validate with pipeline

Run Detection Daemon

# Long-running daemon with hot-reload, health checks, and Prometheus metrics
hel run | rsigma daemon -r rules/ -p ecs.yml --api-addr 0.0.0.0:9090

# With correlation state persistence
hel run | rsigma daemon -r rules/ -p ecs.yml --state-db ./state.db

# With suppression and correlation event inclusion
rsigma daemon -r rules/ --suppress 5m --correlation-event-mode full

For the full rsigma CLI reference, see references/rsigma.md.

---

Backend Selection Guide

For the full list of 25+ backends with install commands, see references/backends.md.

Choosing Between sigma-cli and rsigma

---

End-to-End Workflows

Convert a Rule to Splunk SPL

# Install the Splunk backend
sigma plugin install splunk

# Convert with Sysmon pipeline
sigma convert -t splunk -p sysmon rules/windows/process_creation/shadow_copy_deletion.yml

# Convert as saved search config
sigma convert -t splunk -p sysmon -f savedsearches -o saved.conf rules/

# With backend options
sigma convert -t splunk -p sysmon -O index=main rules/

Convert a Rule to Elasticsearch

sigma plugin install elasticsearch

# Lucene query (default)
sigma convert -t elasticsearch -p ecs_windows rules/

# ES|QL format
sigma convert -t elasticsearch -p ecs_windows -f esql rules/

# Kibana NDJSON (importable)
sigma convert -t elasticsearch -p ecs_windows -f kibana_ndjson -o export.ndjson rules/

Convert a Rule to Microsoft Sentinel KQL

sigma plugin install kusto

# ASIM pipeline
sigma convert -t kusto -p sentinel_asim rules/

Evaluate a Rule Against Live Events (rsigma)

# Single event test
rsigma eval -r rules/ -p ecs.yml -e '{"process.command_line": "vssadmin delete shadows /all"}'

# Stream from file with full event in output
rsigma eval -r rules/ -p ecs.yml --include-event -e @events.ndjson

# With jq extraction from wrapped events
rsigma eval -r rules/ --jq '.event' -e '{"ts":"...","event":{"CommandLine":"whoami"}}'

Lint and Fix a Rule Directory (rsigma)

# Lint all rules
rsigma lint rules/

# Auto-fix safe issues (lowercase keys, remove duplicates, etc.)
rsigma lint rules/ --fix

# Lint with JSON schema validation
rsigma lint rules/ --schema default

# Lint with custom config
rsigma lint rules/ --config .rsigma-lint.yml

Run a Detection Daemon with Correlation (rsigma)

# Basic daemon -- reads NDJSON from stdin, outputs matches to stdout
hel run | rsigma daemon -r rules/ -p ecs.yml

# With correlation state persistence (survives restarts)
hel run | rsigma daemon \
  -r rules/ \
  -p ecs.yml \
  --state-db /var/lib/rsigma/state.db \
  --suppress 5m \
  --action reset \
  --api-addr 0.0.0.0:9090

# Health and metrics
curl http://localhost:9090/healthz           # {"status": "ok"}
curl http://localhost:9090/metrics           # Prometheus format
curl http://localhost:9090/api/v1/status     # full daemon status
curl -X POST http://localhost:9090/api/v1/reload  # hot-reload rules

---

Pipeline Selection

Pipelines transform Sigma rule fields to match your backend's data model. Stack multiple pipelines with repeated -p flags.

Common Patterns

Stacking Pipelines

Pipelines run in priority order (lower priority number = runs first):

# Log source pipeline (priority 10) + backend pipeline (priority 50)
sigma convert -t splunk -p sysmon -p splunk_cim_dm rules/

# rsigma: same stacking with -p
rsigma eval -r rules/ -p sysmon.yml -p ecs.yml -e '...'

Custom Pipelines

Write your own pipeline YAML for organization-specific field mappings:

name: My Organization ECS
priority: 20
transformations:
  - type: field_name_mapping
    mapping:
      CommandLine: process.command_line
      Image: process.executable
      User: user.name
    rule_conditions:
      - type: logsource
        product: windows

For detailed pipeline-to-SIEM mapping and field mapping tables, see references/pipeline-mapping.md.

---

Additional References

• sigma-cli command reference -- all commands, flags, and output formats
• rsigma CLI reference -- eval, lint, validate, daemon, parse
• All backends -- 25+ pySigma backends with install commands
• Pipeline-to-backend mapping -- field mapping tables for ECS, CIM, Sysmon

Sigma Backends Skill

An Agent Skill for converting, evaluating, and deploying Sigma detection rules across SIEM backends.

What This Skill Does

This skill teaches AI agents how to work with Sigma rules across backends:

• sigma-cli (pySigma): convert rules to Splunk SPL, Elasticsearch Lucene/ES|QL, Microsoft Sentinel KQL, QRadar AQL, and 20+ other query languages
• rsigma: evaluate rules directly against JSON events in real time, lint rules (65 checks with auto-fix), validate, and run a detection daemon with correlation, hot-reload, and Prometheus metrics
• Pipeline mapping: which pipeline to use for which SIEM, field mapping tables for ECS, Splunk CIM, and Sysmon

Complements the sigma-rules skill for rule authoring.

Install

npx skills add timescale/sigma-backends -g -y

Or install for a specific agent:

npx skills add timescale/sigma-backends -g -a cursor -y
npx skills add timescale/sigma-backends -g -a claude-code -y

Structure

sigma-backends/
├── SKILL.md                          # Main skill — quick starts, backend guide, workflows
└── references/
    ├── sigma-cli.md                  # Full sigma-cli command reference
    ├── rsigma.md                     # Full rsigma CLI reference
    ├── backends.md                   # All 25+ pySigma backends
    └── pipeline-mapping.md           # SIEM-to-pipeline mapping and field tables

Coverage

• sigma-cli: convert, list, plugin management, output formats
• rsigma: eval, lint (65 rules, --fix), validate, daemon (hot-reload, Prometheus, state persistence)
• 25+ backends: Splunk, Elasticsearch, OpenSearch, Microsoft Sentinel, CrowdStrike, QRadar, InsightIDR, Loki, Carbon Black, Cortex XDR, SentinelOne, Google SecOps, and more
• Pipeline mapping: ECS, Splunk CIM, Sysmon field tables, pipeline stacking, priority conventions

References

• Sigma Specification
• pySigma
• sigma-cli
• rsigma

License

MIT

pySigma Backends Reference

All available pySigma backends for converting Sigma rules to SIEM-specific queries. Install with sigma plugin install <identifier>.

For rsigma (direct evaluation against JSON events), no backend plugin is needed -- see rsigma.md.

---

Major SIEMs

Splunk -- splunk

State: Stable Query Language: SPL, tstats data model queries Output Formats: default (plain SPL), savedsearches (savedsearches.conf), data_model (tstats) Pipelines: splunk_windows, splunk_cim_dm, sysmon

sigma plugin install splunk
sigma convert -t splunk -p splunk_cim_dm rules/

Elasticsearch -- elasticsearch

State: Stable Query Language: Lucene, ES|QL (with correlations), EQL Output Formats: default (Lucene), kibana_ndjson, esql, eql, dsl_lucene Pipelines: ecs_windows, ecs_windows_old, sysmon

sigma plugin install elasticsearch
sigma convert -t elasticsearch -p ecs_windows rules/
sigma convert -t elasticsearch -p ecs_windows -f esql rules/

OpenSearch -- opensearch

State: Stable Query Language: Lucene Output Formats: default (Lucene), alerting rules Pipelines: ecs_windows

sigma plugin install opensearch
sigma convert -t opensearch -p ecs_windows rules/

Microsoft Sentinel / Azure -- kusto

State: Stable Query Language: KQL (Kusto Query Language) Supports: Microsoft XDR Advanced Hunting, Sentinel ASIM, Azure Monitor Pipelines: sentinel_asim, Microsoft 365 Defender tables

sigma plugin install kusto
sigma convert -t kusto -p sentinel_asim rules/

IBM QRadar -- qradar / ibm-qradar-aql

State: Stable Query Language: AQL Two implementations:

• qradar -- community backend with AQL and extension packages
• ibm-qradar-aql -- IBM-maintained backend

sigma plugin install qradar
sigma convert -t qradar rules/

# Or IBM's version
sigma plugin install ibm-qradar-aql
sigma convert -t ibm-qradar-aql rules/

Rapid7 InsightIDR -- insightidr

State: Stable Query Language: LEQL

sigma plugin install insightidr
sigma convert -t insightidr rules/

Grafana Loki -- loki

State: Stable Query Language: LogQL Output Formats: default (LogQL), ruler (Loki ruler YAML for alerting) Pipelines: Built-in mappings for Grafana and promtail Sysmon data

sigma plugin install loki
sigma convert -t loki rules/
sigma convert -t loki -f ruler rules/    # alerting rules

---

EDR Platforms

Carbon Black -- carbonblack

State: Stable Supports: Enterprise EDR (Threat Hunter) and EDR (Response)

sigma plugin install carbonblack
sigma convert -t carbonblack rules/

Cortex XDR -- cortexxdr

State: Stable Query Language: XQL

sigma plugin install cortexxdr
sigma convert -t cortexxdr rules/

CrowdStrike Falcon -- crowdstrike

State: Stable Includes: Pipelines for CrowdStrike Falcon platform and Falcon Data Replicator (FDR) logs

sigma plugin install crowdstrike
sigma convert -t crowdstrike rules/

SentinelOne -- sentinelone

State: Stable Query Language: Deep Visibility queries

sigma plugin install sentinelone
sigma convert -t sentinelone rules/

SentinelOne PowerQuery -- sentinelone-pq

State: Stable Query Language: PowerQuery

sigma plugin install sentinelone-pq
sigma convert -t sentinelone-pq rules/

---

Cloud and Other

Google SecOps (Chronicle) -- secops

State: Development Query Language: UDM searches and YARA-L 2.0 detection rules

sigma plugin install secops
sigma convert -t secops rules/

Logpoint -- logpoint

State: Stable

sigma plugin install logpoint
sigma convert -t logpoint rules/

Panther -- panther

State: Stable

sigma plugin install panther
sigma convert -t panther rules/

Datadog Cloud SIEM -- datadog

State: Testing Query Language: Datadog Query Syntax

sigma plugin install datadog
sigma convert -t datadog rules/

uberAgent -- uberagent

State: Stable

sigma plugin install uberagent
sigma convert -t uberagent rules/

---

Specialized / Niche

---

Plugin States

Use sigma plugin list -t backend for the current definitive list with states.

Pipeline-to-Backend Mapping

Reference for which processing pipelines to use with which SIEM backends, and the field mappings they provide.

Pipeline Selection by SIEM

Log Source Pipelines

These map Sigma's generic logsource to specific data sources:

---

Pipeline Priority Conventions

Pipelines run in ascending priority order. Standard convention:

Stack multiple layers:

# Log source (10) + custom (20) → backend auto-applies its own (50)
sigma convert -t splunk -p sysmon -p splunk_cim_dm rules/

rsigma eval -r rules/ -p sysmon.yml -p ecs.yml -e '...'

---

ECS Field Mapping (Elastic Common Schema)

Common field mappings for Windows process creation events:

Network connection events:

Authentication events:

---

Splunk CIM Field Mapping

Common field mappings for Splunk Common Information Model:

---

Sysmon Field Names

Sysmon events use specific field names that differ from generic Sigma:

The sysmon pipeline maps these Sysmon-specific field names to generic Sigma field names.

---

Writing Custom Pipelines

For organization-specific field mappings:

name: My Org Windows ECS
priority: 20
transformations:
  - type: field_name_mapping
    mapping:
      CommandLine: process.command_line
      Image: process.executable
      ParentImage: process.parent.executable
      User: user.name
      SourceIP: source.ip
      DestinationIP: destination.ip
    rule_conditions:
      - type: logsource
        product: windows

  - type: change_logsource
    product: my_product
    rule_conditions:
      - type: logsource
        product: windows

Conditional Transforms by Category

name: Category-Specific Mapping
priority: 20
transformations:
  - type: field_name_mapping
    mapping:
      Image: process.executable
      CommandLine: process.command_line
    rule_conditions:
      - type: logsource
        category: process_creation

  - type: field_name_mapping
    mapping:
      TargetFilename: file.path
      Image: process.executable
    rule_conditions:
      - type: logsource
        category: file_event

For the full list of 26 transformation types and all condition types, see the sigma-rules skill's pipeline reference.

rsigma CLI Reference

Full reference for rsigma, a Rust CLI for parsing, validating, linting, evaluating, and running Sigma detection rules.

Installation

cargo install rsigma

---

rsigma eval

Evaluate JSON events against Sigma detection and correlation rules.

rsigma eval -r <rules> [-p <pipeline>]... [-e <event>] [options]

Event Input Modes

Examples

# Single event
rsigma eval -r rules/ -e '{"CommandLine": "whoami"}'

# NDJSON file
rsigma eval -r rules/ -e @events.ndjson

# Stream from stdin with pipeline
cat events.ndjson | rsigma eval -r rules/ -p ecs.yml

# Extract nested event with jq
rsigma eval -r rules/ --jq '.event' -e '{"wrapper":true,"event":{"CommandLine":"whoami"}}'

# Array unwrap
rsigma eval -r rules/ --jq '.records[]' -e '{"records":[{"EventID":1},{"EventID":2}]}'

# Full event in output
rsigma eval -r rules/ --include-event -e @events.ndjson

# Correlation with suppression
rsigma eval -r rules/ --suppress 5m --action reset < events.ndjson

# Only correlation alerts (no per-event detections)
rsigma eval -r rules/ --no-detections --correlation-event-mode full < events.ndjson

Detection Match Output

{
  "rule_title": "Detect Whoami",
  "rule_id": "abc-123-...",
  "level": "medium",
  "tags": ["attack.execution"],
  "matched_selections": ["selection"],
  "matched_fields": [
    { "field": "CommandLine", "value": "cmd /c whoami" }
  ],
  "event": null
}

Correlation Match Output

{
  "rule_title": "Brute Force",
  "rule_id": null,
  "level": "high",
  "tags": [],
  "correlation_type": "event_count",
  "group_key": [["User", "admin"]],
  "aggregated_value": 3.0,
  "timespan_secs": 300,
  "events": null,
  "event_refs": null
}

---

rsigma lint

Run 65 built-in lint rules with optional JSON schema validation.

rsigma lint <path> [options]

Lint Categories

Auto-Fixable Rules (13)

Invalid status, invalid level, non-lowercase keys, duplicate tags, duplicate references, duplicate fields, single value |all, |all with |re, wildcard-only value, logsource value not lowercase, filter has level, filter has status, unknown key (typo correction).

Suppression

Three-tier system:

• CLI: --disable rule1,rule2
• Config file: .rsigma-lint.yml with disabled_rules and severity_overrides
• Inline comments: # rsigma-disable, # rsigma-disable-next-line

# .rsigma-lint.yml
disabled_rules:
  - missing_description
  - missing_author
severity_overrides:
  title_too_long: info

Examples

rsigma lint rules/                                    # lint all
rsigma lint rules/ -v                                 # verbose
rsigma lint rules/ --fix                              # auto-fix safe issues
rsigma lint rules/ --schema default                   # + JSON schema
rsigma lint rule.yml --schema my-schema.json          # local schema
rsigma lint rules/ --disable missing_description      # suppress rules
rsigma lint rules/ --config my-lint.yml               # explicit config

---

rsigma validate

Parse and compile all rules in a directory, reporting errors.

rsigma validate <path> [-v] [-p <pipeline>]

rsigma validate rules/ -v
rsigma validate rules/ -p ecs.yml

---

rsigma daemon

Run as a long-running detection service with hot-reload and HTTP APIs.

rsigma daemon -r <rules> [-p <pipeline>]... [options]

HTTP Endpoints

Prometheus Metrics

Hot-Reload Triggers

• File system changes to .yml/.yaml files (debounced 500ms)
• SIGHUP signal (Unix)
• POST /api/v1/reload

State Persistence

With --state-db, correlation state (window entries, suppression timestamps, event buffers) is persisted to SQLite. State survives restarts -- a correlation that saw 2 of 3 required events before restart resumes from 2. Uses WAL journal mode; entries are keyed by stable rule identifiers.

---

rsigma parse

Parse a Sigma YAML file and output the AST as JSON.

rsigma parse rule.yml

rsigma condition

Parse a condition expression and output the AST as JSON.

rsigma condition 'selection and not filter'

rsigma stdin

Read a Sigma YAML document from stdin and output the AST as JSON.

cat rule.yml | rsigma stdin

---

Environment Variables

Exit Codes

sigma-cli Command Reference

Full reference for the official sigma-cli tool (v2.x), which wraps pySigma for command-line Sigma rule conversion.

Installation

pip install sigma-cli

---

sigma convert

Convert Sigma rules into backend-specific queries.

sigma convert -t <backend> [-p <pipeline>]... [-f <format>] [-o <output>] [-O <key=value>]... <input>

Examples

# Convert to Splunk SPL with Sysmon pipeline
sigma convert -t splunk -p sysmon rules/windows/

# Convert to Elasticsearch Lucene with ECS pipeline
sigma convert -t elasticsearch -p ecs_windows rules/

# Convert to Kibana NDJSON format for import
sigma convert -t elasticsearch -p ecs_windows -f kibana_ndjson -o export.ndjson rules/

# Convert to Splunk saved searches config
sigma convert -t splunk -p sysmon -f savedsearches -o saved.conf rules/

# Convert to KQL for Microsoft Sentinel with ASIM
sigma convert -t kusto -p sentinel_asim rules/

# With backend options
sigma convert -t splunk -p sysmon -O index=main -O source=WinEventLog rules/

# Multiple pipelines (applied in order)
sigma convert -t splunk -p sysmon -p splunk_cim_dm rules/

---

sigma list

List available backends, output formats, pipelines, and validators.

sigma list targets

Show locally installed backends:

sigma list targets

sigma list formats

Show output formats for a specific backend:

sigma list formats <backend>

Example output:

+----------------+----------------------------------------+
| Format         | Description                            |
+----------------+----------------------------------------+
| default        | Plain SPL queries                      |
| savedsearches  | Splunk savedsearches.conf format       |
| data_model     | Splunk data model queries              |
+----------------+----------------------------------------+

sigma list pipelines

Show available processing pipelines:

sigma list pipelines

sigma list validators

Show available rule validators:

sigma list validators

---

sigma plugin

Manage backend plugins.

sigma plugin list

Show all available plugins (backends, pipelines, validators):

sigma plugin list                # all plugins
sigma plugin list -t backend     # only backends
sigma plugin list -t pipeline    # only pipelines

Output columns: Identifier, Type, State (stable/testing/development), Description.

sigma plugin install

Install a plugin:

sigma plugin install <identifier>

sigma plugin uninstall

Remove a plugin:

sigma plugin uninstall <identifier>

---

sigma check

Validate Sigma rule syntax:

sigma check <input>

Checks rule structure against the Sigma specification without converting.

---

Output Formats by Backend

Each backend provides its own set of output formats. Common patterns:

Use sigma list formats <backend> for the definitive list after installing a plugin.

---

Pipeline Specification

Pipelines can be specified by name (for built-in pipelines bundled with a backend plugin) or by file path (for custom YAML pipelines):

# By name (built-in)
sigma convert -t splunk -p sysmon rules/

# By file path (custom)
sigma convert -t splunk -p ./my-pipeline.yml rules/

# Multiple (stacked in order)
sigma convert -t elasticsearch -p sysmon -p ecs_windows -p ./custom.yml rules/

---

Exit Codes