retour aux outils back to tools Ducklings

sigma-cli

Outil en ligne de commande pour la gestion des règles de détection Sigma. Convertit les règles Sigma vers des langages de requête SIEM : Splunk, Elasticsearch, QRadar, ArcSight, et plus encore. Command-line tool for Sigma detection rule management. Converts Sigma rules to SIEM query languages — Splunk, Elasticsearch, QRadar, ArcSight, and more.

↗ https://github.com/SigmaHQ/sigma-cli

Overview

sigma-cli is the official command-line tool for working with Sigma detection rules. Sigma is an open, vendor-neutral SIEM rule format — sigma-cli converts rules to specific SIEM query languages (Splunk SPL, Elasticsearch DSL, QRadar AQL, etc.) and manages rule collections.

Installation

pip3 install sigma-cli
# Install backend plugins for specific SIEMs
pip3 install pySigma-backend-splunk
pip3 install pySigma-backend-elasticsearch
pip3 install pySigma-backend-qradar

Basic Usage

Convert a Sigma rule to Splunk query

sigma convert -t splunk -p splunk-windows rule.yml

Convert to Elasticsearch

sigma convert -t elasticsearch -p ecs-windows rule.yml

Convert directory of rules

sigma convert -t splunk -p splunk-windows /path/to/rules/

List available backends (SIEMs)

sigma list backends

List available processing pipelines

sigma list pipelines

Sigma Rule Format

# Example Sigma rule structure
title: Suspicious PowerShell Encoded Command
id: 5b572db9-0234-4b4a-a254-8be3d2bd3264
status: experimental
description: Detects PowerShell with encoded command execution
author: Security Team
date: 2024/01/15
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '-EncodedCommand'
            - '-enc '
            - '-ec '
    condition: selection
falsepositives:
    - Legitimate administration scripts
level: medium

Backend-Specific Conversion

Splunk (Windows)

sigma convert -t splunk -p splunk-windows rule.yml

Splunk (Linux)

sigma convert -t splunk -p splunk-linux rule.yml

Elasticsearch ECS

sigma convert -t elasticsearch -p ecs-windows rule.yml

Lucene query (for Kibana)

sigma convert -t lucene -p ecs-windows rule.yml

QRadar

sigma convert -t qradar -p qradar-windows rule.yml

Microsoft Sentinel (KQL)

sigma convert -t microsoft365defender rule.yml

Rule Management

Check rule syntax

sigma check rule.yml

Check directory of rules

sigma check /path/to/rules/

Format/lint rules

sigma format rule.yml

List rule metadata

sigma list rules /path/to/rules/

Downloading Official Rule Sets

Clone the official Sigma rules repository

git clone https://github.com/SigmaHQ/sigma /opt/sigma

Convert all Windows rules to Splunk

sigma convert -t splunk -p splunk-windows \
  /opt/sigma/rules/windows/ \
  -o splunk_windows_rules.spl
# Convert only high/critical severity rules
find /opt/sigma/rules/ -name "*.yml" -exec grep -l "level: critical\|level: high" {} \; > high_rules.txt
sigma convert -t splunk -p splunk-windows $(cat high_rules.txt) -o high_priority.spl

Tips

  • sigma-cli is the bridge between rule writing and SIEM deployment
  • Always validate rules with sigma check before deployment
  • The official Sigma rule repo has 2000+ detection rules covering MITRE ATT&CK
  • For Splunk users: install the pySigma-backend-splunk plugin for best results
Help / Man page 
sigma [command] [options]

Commands:
  convert     Convert rules to SIEM query language
  check       Validate Sigma rules
  format      Format and normalize rules
  list        List backends, pipelines, or rules

convert options:
  -t BACKEND  Target backend (SIEM)
  -p PIPELINE Processing pipeline
  -o FILE     Output file
  -f FORMAT   Output format

list options:
  backends    Show available backends
  pipelines   Show available pipelines
  rules DIR   List rules in directory

Vue d’ensemble

sigma-cli est l’outil en ligne de commande officiel pour travailler avec les règles de détection Sigma. Sigma est un format de règle SIEM ouvert et agnostique du vendeur : sigma-cli convertit les règles vers des langages de requête SIEM spécifiques (Splunk SPL, Elasticsearch DSL, QRadar AQL, etc.) et gère les collections de règles.

Installation

pip3 install sigma-cli
# Installer des plugins backend pour des SIEM spécifiques
pip3 install pySigma-backend-splunk
pip3 install pySigma-backend-elasticsearch
pip3 install pySigma-backend-qradar

Utilisation de base

# Convertir une règle Sigma en requête Splunk
sigma convert -t splunk -p splunk-windows rule.yml

# Convertir vers Elasticsearch
sigma convert -t elasticsearch -p ecs-windows rule.yml

# Convertir un répertoire de règles
sigma convert -t splunk -p splunk-windows /path/to/rules/

# Lister les backends disponibles (SIEM)
sigma list backends

# Lister les pipelines de traitement disponibles
sigma list pipelines

Format de règle Sigma

# Exemple de structure de règle Sigma
title: Suspicious PowerShell Encoded Command
id: 5b572db9-0234-4b4a-a254-8be3d2bd3264
status: experimental
description: Detects PowerShell with encoded command execution
author: Security Team
date: 2024/01/15
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '-EncodedCommand'
            - '-enc '
            - '-ec '
    condition: selection
falsepositives:
    - Legitimate administration scripts
level: medium

Conversion spécifique par backend

# Splunk (Windows)
sigma convert -t splunk -p splunk-windows rule.yml

# Splunk (Linux)
sigma convert -t splunk -p splunk-linux rule.yml

# Elasticsearch ECS
sigma convert -t elasticsearch -p ecs-windows rule.yml

# Requête Lucene (pour Kibana)
sigma convert -t lucene -p ecs-windows rule.yml

# QRadar
sigma convert -t qradar -p qradar-windows rule.yml

# Microsoft Sentinel (KQL)
sigma convert -t microsoft365defender rule.yml

Gestion des règles

# Vérifier la syntaxe d'une règle
sigma check rule.yml

# Vérifier un répertoire de règles
sigma check /path/to/rules/

# Formater/linter les règles
sigma format rule.yml

# Lister les métadonnées des règles
sigma list rules /path/to/rules/

Télécharger les jeux de règles officiels

# Cloner le dépôt officiel des règles Sigma
git clone https://github.com/SigmaHQ/sigma /opt/sigma

# Convertir toutes les règles Windows en Splunk
sigma convert -t splunk -p splunk-windows \
  /opt/sigma/rules/windows/ \
  -o splunk_windows_rules.spl
# Convertir uniquement les règles de sévérité haute/critique
find /opt/sigma/rules/ -name "*.yml" -exec grep -l "level: critical\|level: high" {} \; > high_rules.txt
sigma convert -t splunk -p splunk-windows $(cat high_rules.txt) -o high_priority.spl

Conseils

  • sigma-cli fait le pont entre l’écriture des règles et leur déploiement en SIEM
  • Toujours valider les règles avec sigma check avant déploiement
  • Le dépôt officiel de règles Sigma compte plus de 2000 règles de détection couvrant MITRE ATT&CK
  • Pour les utilisateurs Splunk : installer le plugin pySigma-backend-splunk pour de meilleurs résultats
Aide / Page de manuel 
sigma [command] [options]

Commands:
  convert     Convert rules to SIEM query language
  check       Validate Sigma rules
  format      Format and normalize rules
  list        List backends, pipelines, or rules

convert options:
  -t BACKEND  Target backend (SIEM)
  -p PIPELINE Processing pipeline
  -o FILE     Output file
  -f FORMAT   Output format

list options:
  backends    Show available backends
  pipelines   Show available pipelines
  rules DIR   List rules in directory