Create new logsource pipeline for zeek:conn.log in Security Onion

[HBadger0017]

I've got a project to develop a logsource for zeek:conn.log in Security Onion for Sigma correlations. So far I've been working through the documentation for both SecO and Sigma but have not found information on where to place the pipeline in SecO to make the logsource available (I want to expand this to include zeek:modbus.log as well).

I may be misunderstanding how this development process works but my end goal is to correlate behaviors in OT environments that do not have the luxury of host logging.

Where are the current logsource pipelines reside in SecO for use in the Detection modules? I'm looking for working examples to RE.

[nasbench]

Please submit this question to SecO this is a rule repo for Sigma. You can read the docs of sigma here https://sigmahq.io/ and the spec here https://github.com/SigmaHQ/sigma-specification