search

SigmaHQ / pySigma-backend-elasticsearch

pySigma Elasticsearch backend
GNU Lesser General Public License v3.0
42 stars 24 forks source link

Elastalert backend #75

Open m4dh4t opened 3 weeks ago

m4dh4t commented 3 weeks ago

Hi.

@kurisukun and myself drafted a backend converting Sigma rules into Elastalert rules, inheriting from LuceneBackend. It currently supports simple rules as well as the event_count and value_count correlation rules. You can find the relevant code here: https://github.com/m4dh4t/pySigma-backend-elasticsearch/tree/feat-elastalert-backend

Would you @andurin be interested in this being merged in pySigma-backend-elasticsearch as this backend was originally supported by sigmac ? I think it would make sense as this backend is strongly linked to Elasticsearch.

If not, we will create a dedicated repository for it.