{ "plugins": { "c29da56a-f2df-11ed-a05b-0242ac120003": { "id": "ibm-qradar-aql", "type": "backend", "description": "IBM QRadar backend for conversion into AQL queries. Contains mappings for fields and logsources", "package": "pysigma-backend-qradar-aql", "project-url": "https://github.com/IBM/pySigma-backend-QRadar-aql", "report-issue-url": "https://github.com/IBM/pySigma-backend-QRadar-aql/issues/new", "state": "stable", "pysigma-version": "~=0.10.3" }, "5f9a6987-3f39-4b6b-abd8-60aaee9c7021":{ "id": "rclinuxedr", "type": "pipeline", "description": "Red Canary LinuxEDR pipeline that converts fields to Telemetry Search mapping.", "package": "pySigma-pipeline-rclinuxedr", "project-url": "https://github.com/7RedViolin/pySigma-pipeline-rclinuxedr", "report-issue-url":"https://github.com/7RedViolin/pySigma-pipeline-rclinuxedr/issues/new", "state": "stable", "pysigma-version": ">=0.11.4" }, "f7444f11-f49b-4936-984a-a74f192059de":{ "id": "cortexxdr", "type": "backend", "description": "Cortex XDR backend that generates XQL queries.", "package": "pysigma-backend-cortexxdr", "project-url": "https://github.com/7RedViolin/pySigma-backend-cortexxdr", "report-issue-url": "https://github.com/7RedViolin/pySigma-backend-cortexxdr/issues/new", "state": "stable", "pysigma-version": ">=0.9.8" }, "f0aa1c83-b406-4ff9-8afa-e5d28e55e074": { "id": "carbonblack", "type": "backend", "description": "Carbon Black backend that supports queries for both Enterprise EDR (fka Threat Hunter) and EDR (fka Response)", "package": "pysigma-backend-carbonblack", "project-url": "https://github.com/7RedViolin/pySigma-backend-carbonblack", "report-issue-url": "https://github.com/7RedViolin/pySigma-backend-carbonblack/issues/new", "state": "stable", "pysigma-version": ">=0.9.6" }, "6f294a42-e43e-11ed-b5ea-0242ac120002": { "id": "sentinelone", "type": "backend", "description": "SentinelOne backend that generates Deep Visibility queries.", "package": "pysigma-backend-sentinelone", "project-url": "https://github.com/7RedViolin/pySigma-backend-sentinelone", "report-issue-url": "https://github.com/7RedViolin/pySigma-backend-sentinelone/issues/new", "state": "stable", "pysigma-version": ">=0.9.5" }, "4f57aff1-1144-46d7-b593-21f1d86c358f": { "id": "sentinelone-pq", "type": "backend", "description": "SentinelOne backend that generates PowerQuery queries.", "package": "pysigma-backend-sentinelone-pq", "project-url": "https://github.com/7RedViolin/pySigma-backend-sentinelone-pq", "report-issue-url": "https://github.com/7RedViolin/pySigma-backend-sentinelone-pq/issues/new", "state": "stable", "pysigma-version": ">=0.9.5" }, "4af37b53-f1ec-4567-8017-2fb9315397a1": { "id": "splunk", "type": "backend", "description": "Splunk backend for conversion into SPL and tstats data model queries as plain queries and savedsearches.conf", "package": "pysigma-backend-splunk", "project-url": "https://github.com/SigmaHQ/pySigma-backend-splunk", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-splunk/issues/new", "state": "stable", "capabilities": [ "event_count_correlation_conversion", "value_count_correlation_conversion", "temporal_correlation_conversion" ], "pysigma-version": "~=0.11.1" }, "cf14a3da-23c1-408e-90a3-03bf72ea4f0c": { "id": "insightidr", "type": "backend", "description": "Rapid7 InsightIDR backend that generates LEQL queries.", "package": "pysigma-backend-insightidr", "project-url": "https://github.com/SigmaHQ/pySigma-backend-insightidr", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-insightidr/issues/new", "state": "stable", "pysigma-version": "~=0.10.1" }, "f07b25e1-d066-4369-a9fb-ab3fe59f1dfe": { "id": "qradar", "type": "backend", "description": "IBM QRadar backend for conversion into AQL and extension packages.", "package": "pysigma-backend-qradar", "project-url": "https://github.com/nNipsx-Sec/pySigma-backend-qradar", "report-issue-url": "https://github.com/nNipsx-Sec/pySigma-backend-qradar/issues/new", "state": "stable", "pysigma-version": "~=0.9.4" }, "5cb793f1-9719-4ad2-833e-53e06a0da3ab": { "id": "elasticsearch", "type": "backend", "description": "Elasticsearch backend converting into Lucene, ES|QL (with correlations) and EQL queries, plain, embedded into DSL or as Kibana NDJSON.", "package": "pysigma-backend-elasticsearch", "project-url": "https://github.com/SigmaHQ/pySigma-backend-elasticsearch", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-elasticsearch/issues/new", "state": "stable", "capabilities": [ "event_count_correlation_conversion", "value_count_correlation_conversion", "temporal_correlation_conversion" ], "pysigma-version": "~=0.11.3" }, "e6e86698-9ee8-443f-9a22-edd1784c265b": { "id": "opensearch", "type": "backend", "description": "Opensearch backend converting into Lucene queries and Opensearch alerting rules.", "package": "pysigma-backend-opensearch", "project-url": "https://github.com/SigmaHQ/pySigma-backend-opensearch", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-opensearch/issues/new", "state": "stable", "pysigma-version": "~=0.10.2" }, "0bcae3dd-a8fc-4c81-b0ea-203d6176d3de": { "id": "stix", "type": "backend", "description": "STIX backend converting into plain STIX queries. Contains mappings for STIX 2.0 and STIX Shifter taxonomies.", "package": "git+https://github.com/barvhaim/pySigma-backend-stix", "project-url": "https://github.com/barvhaim/pySigma-backend-stix/", "report-issue-url": "https://github.com/barvhaim/pySigma-backend-stix/issues/new", "state": "devel", "pysigma-version": "~=0.9.5" }, "224e5429-a291-4ca2-b53f-6dbfdee5e96b": { "id": "loki", "type": "backend", "description": "Loki backend for conversion into Loki LogQL queries (plain and ruler YAML for alerts) and pipelines with mappings for Grafana and promtail Sysmon data.", "package": "pySigma-backend-loki", "project-url": "https://github.com/grafana/pySigma-backend-loki", "report-issue-url": "https://github.com/grafana/pySigma-backend-loki/issues/new", "state": "stable", "capabilities": [ "event_count_correlation_conversion", "value_count_correlation_conversion" ], "pysigma-version": "~=0.11.13" }, "f2bb108f-d1ec-4e5b-a214-1151ebd99b20": { "id": "windows", "type": "pipeline", "description": "Windows logsource to Channel field and generic logsource to Windows audit events mapping.", "package": "pysigma-pipeline-windows", "project-url": "https://github.com/SigmaHQ/pySigma-pipeline-windows", "report-issue-url": "https://github.com/SigmaHQ/pySigma-pipeline-windows/issues/new", "state": "stable", "pysigma-version": "~=0.11" }, "7b231e92-bd92-4233-9788-e80be64c2777": { "id": "sysmon", "type": "pipeline", "description": "Mapping from generic log sources to Sysmon events.", "package": "pysigma-pipeline-sysmon", "project-url": "https://github.com/SigmaHQ/pySigma-pipeline-sysmon", "report-issue-url": "https://github.com/SigmaHQ/pySigma-pipeline-sysmon/issues/new", "state": "stable", "pysigma-version": "~=0.11" }, "373be3fa-ad6d-456b-a7d2-a876d87ad581": { "id": "crowdstrike", "type": "backend", "description": "CrowdStrike Logscale backend and pipelines for CrowdStrike Falcon platform and Falcon Data Replicator (FDR) logs.", "package": "pysigma-backend-crowdstrike", "project-url": "https://github.com/SigmaHQ/pySigma-backend-crowdstrike", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-crowdstrike/issues/new", "state": "stable", "pysigma-version": "~=0.11.13" }, "28c68c9f-9162-4b33-97c9-ea4a14dc93d9": { "id": "ossem", "type": "pipeline", "description": "Mapping from OSSEM to Sigma taxonomy.", "package": "git+https://github.com/SigmaHQ/pySigma-pipeline-ossem.git", "project-url": "https://github.com/SigmaHQ/pySigma-pipeline-ossem", "report-issue-url": "https://github.com/SigmaHQ/pySigma-pipeline-ossem/issues/new", "state": "devel", "pysigma-version": "~=0.8.1" }, "8f2c9105-0ad4-47b0-b5e0-261feb82e219": { "id": "powershell", "type": "backend", "description": "PowerShell backend converting into PowerShell queries.", "package": "git+https://github.com/cyberphor/pySigma-backend-powershell.git", "project-url": "https://github.com/cyberphor/pySigma-backend-powershell", "report-issue-url": "https://github.com/cyberphor/pySigma-backend-powershell/issues/new", "state": "testing", "pysigma-version": "~=0.10.1" }, "0a1787ac-8c5b-4d9b-a76b-277d5362e81e": { "id": "kusto", "type": "backend", "description": "Kusto Query Language (KQL) backend and pipeline for conversion of log sources with Sysmon field schema to Microsoft Advanced Hunting Queries", "package": "pySigma-backend-kusto", "project-url": "https://github.com/AttackIQ/pySigma-backend-kusto", "report-issue-url": "https://github.com/AttackIQ/pySigma-backend-kusto/issues/new", "state": "stable", "pysigma-version": ">=0.10.0" }, "48019d9d-c36d-43c0-8ccf-1dfa54434e36": { "id": "secops", "type": "backend", "description": "Google SecOps (formally Chronicle) backend and pipeline for conversion of Sigma Rules to SecOps Unified Data Model (UDM) searches and YARA-L 2.0 detection rules", "package": "pySigma-backend-secops", "project-url": "https://github.com/AttackIQ/pySigma-backend-secops", "report-issue-url": "https://github.com/AttackIQ/pySigma-backend-secops/issues/new", "state": "devel", "pysigma-version": ">=0.11.17" }, "b00b0a05-3621-4029-b37e-03354842a5a3": { "id": "hawk", "type": "backend", "description": "HAWK.io MDR backend and pipeline for conversion of log sources to HAWK.io BETree queries.", "package": "git+https://github.com/redsand/pySigma-backend-hawk.git", "project-url": "https://github.com/redsand/pySigma-backend-hawk", "report-issue-url": "https://github.com/redsand/pySigma-backend-hawk/issues/new", "state": "testing", "pysigma-version": "~=0.9.5" }, "49a1a18a-224a-11ee-be56-0242ac120002": { "id": "datadog", "type": "backend", "description": "Datadog Cloud SIEM backend and pipeline for conversion of log sources to Datadog Query Syntax", "package": "pysigma-backend-datadog", "project-url": "https://github.com/DataDog/pysigma-backend-datadog", "report-issue-url": "https://github.com/DataDog/pysigma-backend-datadog/issues/new", "state": "testing", "pysigma-version": "~=0.11.14" }, "ec5311a2-914e-4745-b622-fddcc9d2af4a": { "id": "dictquery", "type": "backend", "description": "DictQuery backend to convert sigma to dictquery query strings", "package": "pysigma-backend-dictquery", "project-url": "https://github.com/unqork-external/pySigma-backend-dictquery", "report-issue-url": "https://github.com/unqork-external/pySigma-backend-dictquery/issues/new", "state": "stable", "pysigma-version": "~=0.10.5" }, "23ae33fc-b666-411d-aea7-9f40d1f6a189": { "id": "sqlite", "type": "backend", "description": "SQLite and Zircolite backend", "package": "pysigma-backend-sqlite", "project-url": "https://github.com/SigmaHQ/pySigma-backend-sqlite", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-sqlite/issues/new", "state": "testing", "pysigma-version": "~=0.11" }, "4083d306-59da-4d3e-a989-850d818932f7": { "id": "uberagent", "type": "backend", "description": "uberAgent backend", "package": "pysigma-backend-uberagent", "project-url": "https://github.com/vastlimits/pySigma-backend-uberAgent/", "report-issue-url": "https://github.com/vastlimits/pySigma-backend-uberAgent/issues/new", "state": "stable", "pysigma-version": "~=0.11.2" }, "3ec39928-13e7-47fe-baa9-9800351a2e4d" : { "id": "panther", "type": "backend", "description": "Panther backend", "package": "pySigma-backend-panther", "project-url": "https://github.com/panther-labs/pySigma-backend-panther", "report-issue-url": "https://github.com/panther-labs/pySigma-backend-panther/issues/new", "state": "stable", "pysigma-version": "~=0.10" }, "961013dd-e94f-426f-81ad-d754bc5720fc": { "id": "trellix_helix", "type": "backend", "description": "Trellix Helix Backend", "package": "pysigma-backend-helix", "project-url": "https://github.com/sawwn23/pySigma-backend-trellix-helix/", "report-issue-url": "https://github.com/sawwn23/pySigma-backend-trellix-helix/issues/new", "state": "devel", "pysigma-version": "~=0.11.2" }, "3200ecd3-2f32-42ef-90f4-dbe0a66a98e1": { "id": "quickwit", "type": "backend", "description": "Quickwit Backend", "package": "pySigma-backend-quickwit", "project-url": "https://github.com/sifex/pySigma-backend-quickwit/", "report-issue-url": "https://github.com/sifex/pySigma-backend-quickwit/issues/new", "state": "devel", "pysigma-version": "~=0.11.7" }, "c4f5d614-9c3a-4b88-a669-64e38248f2df": { "id": "netwitness", "type": "backend", "description": "NetWitness Backend that generates application rules", "package": "pySigma-backend-netwitness", "project-url": "https://github.com/marcelkwaschny/pySigma-backend-netwitness/", "report-issue-url": "https://github.com/marcelkwaschny/pySigma-backend-netwitness/issues/new", "state": "testing", "pysigma-version": "~=0.11.9" }, "9d3d8962-5491-4fa2-b835-289c9935946b": { "id": "logpoint", "type": "backend", "description": "Logpoint Pysigma Backend", "package": "pySigma-backend-logpoint", "project-url": "https://github.com/logpoint/pySigma-backend-logpoint", "report-issue-url": "https://github.com/logpoint/pySigma-backend-logpoint/issues/new", "state": "stable", "pysigma-version": "~=0.11.13" }, "69a79499-66b1-4f37-9f7d-4cb9f12eba3e": { "id": "surrealql", "type": "backend", "description": "SurrealQL Backend", "package": "pySigma-backend-surrealql", "project-url": "https://github.com/SigmaHQ/pySigma-backend-surrealql", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-surrealql/issues/new/choose", "state": "testing", "pysigma-version": "~=0.11" }, "2460230b-fb23-4109-9688-6e3afc67112a": { "id": "golangexpr", "type": "backend", "description": "Golang Expr Backend", "package": "pySigma-backend-golangexpr", "project-url": "https://github.com/SigmaHQ/pySigma-backend-golangexpr", "report-issue-url": "https://github.com/SigmaHQ/pySigma-backend-golangexpr/issues/new/choose", "state": "testing", "pysigma-version": "~=0.11.19" }, "237738a3-7aca-4009-b75d-3ed3c931ef52": { "id": "ocsf", "type": "pipeline", "description": "Mapping from generic log sources to OCSF events.", "package": "pysigma-pipeline-ocsf", "project-url": "https://github.com/SigmaHQ/pySigma-pipeline-ocsf", "report-issue-url": "https://github.com/SigmaHQ/pySigma-pipeline-ocsf/issues/new", "state": "stable", "pysigma-version": "~=0.11" }, "db31f296-7c83-404b-8346-fb2b0ec43a58": { "id": "sumologic", "type": "backend", "description": "Sumo Logic Cloud SIEM backend for converting Sigma rules to CSE detection rules", "package": "pysigma-backend-sumologic", "project-url": "https://github.com/SumoLogic/pySigma-backend-sumologic", "report-issue-url": "https://github.com/SumoLogic/pySigma-backend-sumologic/issues/new", "state": "stable", "pysigma-version": "~=1.0" }, "7c043d02-0253-40c8-8623-1acd3f06b414": { "id": "clickhouse", "type": "backend", "description": "Clickhouse pysigma backend", "package": "pysigma-backend-clickhouse", "project-url": "https://github.com/clicksiem/pySigma-backend-clickhouse", "report-issue-url": "https://github.com/clicksiem/pySigma-backend-clickhouse/issues/new", "state": "testing", "pysigma-version": ">=1.0.0" }, "cdd1dc58-d537-4176-9c3e-397ab354106e": { "id": "signals", "type": "backend", "description": "Tanium signals backend.", "package": "pySigma-backend-signals", "project-url": "https://github.com/wayne-csrs/pySigma-backend-signals", "report-issue-url": "https://github.com/wayne-csrs/pySigma-backend-signals/issues/new", "state": "testing", "pysigma-version": "~=1.0.0" } } }