Sigma → EQL pipeline

sigmac -t es-eql rule.yml

Converts a Sigma rule to Elastic EQL with sigmac, deploying the detection in the Elastic stack as code.

Use it when the stack is Elastic and you want to carry Sigma rules: sigmac with the es-eql backend converts the YAML rule to EQL (the Elastic Security query over events) and the result is deployed as a detection rule. It is the detection-as-code pipeline for Elastic: the community rule converted to Elastic's language. In purple teaming with Elastic, the Sigma→EQL pipeline standardizes the conversion: the repo rule, the conversion, and the deployment with CI/CD.

Do not use it without the correct mapping: the es-eql backend converts standard fields — the mapping to Elastic fields (ECS) is reviewed in the conversion or in the rule; without it, the query won't find the fields. And watch out: sigmac's conversion to EQL covers rules compatible with EQL — rules with logic not expressible in EQL (complex aggregations) require the query backend (es-qs) or manual adaptation. The converted rule is validated against real data (data streams) before alerting. For mass deployment, Elastic's prebuilt rules complement the pipeline.