Skip to main content

Introduction

Revision History​

DateAuthorSummary
06-NOV-2022TSgt. BernadotteInitial draft
25-SEP-2023TSgt. BernadotteAccounted for Elastic 8.10.2 nav menu changes

Purpose​

The purpose of this SOP is to provide step-by-step instructions for batch converting Sigma rules to Elastic Detection rules while retaining all Sigma rule metadata.

  • Sigma rules with basic detection conditions will be converted to Custom query detection rules
  • Sigma rules with count() detection conditions will be converted to Threshold detection rules
  • Sigma rule descriptions, authors, tags, false positives notes, severity, and reference URLs will be carried over to their corresponding detection rule
  • Sigma rule tags will be parsed for MITRE ATT&CK Tactics and Techniques according to the Sigma tagging standard and added to their corresponding detection rule

Requirements​

  • The Convert-SigmaToDetectionRule.psm1 script from 262COS-Sigma_To_Detection_Rule_Converter-SCRIPT-001 is required to perform the conversions.