Integrate Sigma rules via OpenSearch Security Analytics

[mmguero]

@mmguero cloned issue idaholab/Malcolm#162 on 2023-03-14:

How could Malcolm integrate sigma?

Sigma:

Sigma is a generic and open signature format that allows you to describe relevant log events in a straightforward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this project is to provide a structured form in which researchers or analysts can describe their once developed detection methods and make them shareable with others.

Sigma is for log files what Snort is for network traffic and YARA is for files.

• OpenSearch Security Analytics plugin uses Sigma. Malcolm actually includes this plugin just because it's part of OpenSearch, but we're not really doing anything with it.

• I think Elastic SIEM does as well (?)

[mmguero]

@mavam commented on 2023-03-14:

The current sigmac is going to be deprecated by the end of the year. If you start with this now, I would highly recommend going the pySigma route. That said, I don't know whether the Elasticsearch backend also supports OpenSearch.

You could also consider writing a transpiler, as we did in VAST.

[mmguero]

@mmguero commented on 2023-03-14:

Thanks for the suggestion!

[mmguero]

@mmguero commented on 2024-10-03:

• Sigma taxonomy
  • for mapping, note how product and service seem pretty much to line up with our event.provider and event.dataset.
• log types and mapping

[mmguero]

@mmguero commented on 2024-10-03:

See this thread for an issue I'm having.