What component is used to convert a Sigma rule to EQL query (for ElastAlert)?

[akibako]

Version

3.0.0

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

24GB

Storage for /

200GB (manager)

Storage for /nsm

shared with root partition

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

If possible, the community might benefit from a little more detail (or documentation) about how Sigma rules are converted to the EQL query that ends up in the ElastAlert rule's filter.
Specifically, I've noticed that certain kinds of Sigma detection syntax does not convert the way I expect. Every conversion tool seems to behave differently, so more insight into what component(s) is being used would aid users in avoiding the limitations that currently exist.

A concrete example of unexpected convertion logic is that a Sigma detection like this...

detection:
  selection:
    event_type_id:
      - 1
      - 2
      - 3

...will end up as an EQL query like this:

any where event_type_id like~ (1, 2, 3)

That EQL query will only work if the "event_type_id" field is being mapped as a keyword, and will cause an error if the field is mapped as a number, which is what the Sigma syntax is written for.

Also, many people are eagerly looking forward to Sigma correlations being implemented in the future, so wishing the Team luck!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

We use the official pySigma converter with the elasticsearch-backend. (https://github.com/SigmaHQ/pySigma-backend-elasticsearch)

You probably want to look over our pipeline: https://github.com/Security-Onion-Solutions/securityonion/blob/3/main/salt/soc/files/soc/sigma_so_pipeline.yaml

There are certain places where we convert to a datatype to make sure it is compatible with how we ingest logs, for example: https://github.com/Security-Onion-Solutions/securityonion/blob/3/main/salt/soc/files/soc/sigma_so_pipeline.yaml#L235

Can you give me an example Sigma rule that uses event_type_id in the way that you describe?