pySigma Elasticsearch Backend

This is the Elasticsearch backend for pySigma. It provides the package sigma.backends.elasticsearch with the ElasticsearchQueryStringBackend class. Further, it contains the following processing pipelines in sigma.pipelines.elasticsearch:

• ecs_windows in ecs submodule: ECS mapping for Windows event logs ingested with Winlogbeat.
• ecs_windows_old in ecs submodule: ECS mapping for Windows event logs ingested with Winlogbeat <= 6.x.

It supports the following output formats:

• default: plain Elasticsearch query strings
• kibana: Kibana JSONL with Elasticsearch query strings (not yet implemented)

This backend is currently maintained by:

• Thomas Patzke

Further maintainers required! Send a message to Thomas if you want to co-maintain this backend.