sigma-to-elastalert

Ansible playbook to convert Sigma rules to ElastAlert rules

Takes in a directory of Sigma rules and reads through it recursively, and generates the ElastAlert rules.

If multiple ElastAlert rules are generated from a single Sigma rule, it splits those rules apart and appends _0.yaml, _1.yaml, etc. and saves them to separate rule files.

Files are named .yaml vs .yml for compatibility with Praeco.

Use

Modify path vars in playbook.yml
Point to your own sigma config/backend files in playbook.yml

If you want to use different Sigma configs for different rule categories (ex: windows) or sub categories (ex: sysmon), add a when statement in playbook.yml and point to the appropriate config

- name: Convert rules with sigmac 
  shell: "{{ path_to_sigma }}/tools/sigmac -t elastalert -c \"{{ path_to_sigma }}/tools/config/winlogbeat.yml\" {{ rule_path }} -O http_post_include_rule_metadata -O alert_methods=http_post --backend-config \"{{ path_to_sigma }}/tools/config/backends/config.yml\""
  register: rule
  when: rule_cat == 'windows'

Run

chmod +x sigma-to-elastalert.sh
./sigma-to-elastalert.sh --path_to_sigma_rules /path/to/sigma/rules

jSkripts/sigma-to-elastalert

sigma-to-elastalert

Use