pySigma-backend-signals 0.1.0__tar.gz

pysigma_backend_signals-0.1.0/LICENSE

@@ -0,0 +1,166 @@
+
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

pysigma_backend_signals-0.1.0/PKG-INFO

@@ -0,0 +1,18 @@
+Metadata-Version: 2.4
+Name: pySigma-backend-signals
+Version: 0.1.0
+Summary: pySigma signals backend
+License: LGPL-3.0-only
+License-File: LICENSE
+Author: Wayne Silva
+Author-email: wayne@csrs.ltd
+Requires-Python: >=3.10,<4.0
+Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: pysigma (>=1.0.0)
+Project-URL: Repository, https://github.com/wayne-csrs/pySigma-backend-signals

pysigma_backend_signals-0.1.0/pyproject.toml

@@ -0,0 +1,23 @@
+[tool.poetry]
+name = "pySigma-backend-signals"
+version = "0.1.0"
+description = "pySigma signals backend"
+authors = ["Wayne Silva <wayne@csrs.ltd>"]
+license = "LGPL-3.0-only"
+repository = "https://github.com/wayne-csrs/pySigma-backend-signals"
+packages = [
+    { include = "sigma" }
+]
+
+[tool.poetry.dependencies]
+python = ">=3.10,<4.0"
+pysigma = ">=1.0.0"
+
+[tool.poetry.group.dev.dependencies]
+defusedxml = "^0.7"
+pytest = "^8.0.0"
+pytest-cov = "^7.1.0"
+
+[build-system]
+requires = ["poetry-core>=1.8.1"]
+build-backend = "poetry.core.masonry.api"

pysigma_backend_signals-0.1.0/sigma/backends/signals/__init__.py

@@ -0,0 +1 @@
+from .signals import SignalsBackend, signalsBackend

pysigma_backend_signals-0.1.0/sigma/backends/signals/signals.py

@@ -0,0 +1,272 @@
+import json
+from sigma.conversion.base import TextQueryBackend
+from sigma.conversion.state import ConversionState
+from sigma.conditions import ConditionItem, ConditionAND, ConditionOR, ConditionNOT
+from sigma.correlations import SigmaCorrelationRule
+from sigma.pipelines.signals import signals_pipeline
+from sigma.rule import SigmaRule
+from sigma.types import SigmaCompareExpression, SigmaRegularExpressionFlag
+import re
+from typing import Any, ClassVar, Dict, List, Optional, Pattern, Tuple, Union
+
+# Future backend imports you may enable later:
+# from sigma.conversion.state import ConversionState
+# from sigma.rule import SigmaRule
+# from sigma.types import SigmaRegularExpression
+
+class SignalsBackend(TextQueryBackend):
+    """Signals backend."""
+
+    name: ClassVar[str] = "signals backend"
+    formats: Dict[str, str] = {
+        "default": "Plain signals queries",
+        "json": "JSON output with query and Sigma metadata",
+    }
+    requires_pipeline: ClassVar[bool] = True
+    backend_processing_pipeline = signals_pipeline()
+
+    precedence: ClassVar[Tuple[ConditionItem, ConditionItem, ConditionItem]] = (
+        ConditionNOT,
+        ConditionAND,
+        ConditionOR,
+    )
+    group_expression: ClassVar[str] = "({expr})"
+
+    token_separator: str = " "
+    or_token: ClassVar[str] = "OR"
+    and_token: ClassVar[str] = "AND"
+    not_token: ClassVar[str] = "NOT"
+    eq_token: ClassVar[str] = "="
+
+    field_quote: ClassVar[str] = '"'
+    field_quote_pattern: ClassVar[Pattern] = re.compile(r"^[A-Za-z0-9_.]+$")
+    field_quote_pattern_negation: ClassVar[bool] = True
+
+    field_escape: ClassVar[str] = "\\"
+    field_escape_quote: ClassVar[bool] = True
+    field_escape_pattern: ClassVar[Pattern] = re.compile(r"\s")
+
+    str_quote: ClassVar[str] = "'"
+    escape_char: ClassVar[str] = "\\"
+    wildcard_multi: ClassVar[str] = "*"
+    wildcard_single: ClassVar[str] = "?"
+    add_escaped: ClassVar[str] = "\\"
+    filter_chars: ClassVar[str] = ""
+    bool_values: ClassVar[Dict[bool, str]] = {
+        True: "true",
+        False: "false",
+    }
+
+    startswith_expression: ClassVar[str] = "{field} starts with {value}"
+    endswith_expression: ClassVar[str] = "{field} ends with {value}"
+    contains_expression: ClassVar[str] = "{field} contains {value}"
+    wildcard_match_expression: ClassVar[str] = "{field} matches {value}"
+
+    # Regular expressions
+    # Regular expression query as format string with placeholders {field}, {regex}, {flag_x} where x
+    # is one of the flags shortcuts supported by Sigma (currently i, m and s) and refers to the
+    # token stored in the class variable re_flags.
+    re_expression: ClassVar[str] = "{field} matches regex {regex}"
+    re_escape_char: ClassVar[str] = "\\"
+    re_escape: ClassVar[Tuple[str, ...]] = ()
+    re_escape_escape_char: bool = True
+    re_flag_prefix: bool = True
+    # Mapping from SigmaRegularExpressionFlag values to static string templates that are used in
+    # flag_x placeholders in re_expression template.
+    # By default, i, m and s are defined. If a flag is not supported by the target query language,
+    # remove it from re_flags or don't define it to ensure proper error handling in case of appearance.
+    re_flags: Dict[SigmaRegularExpressionFlag, str] = {
+        SigmaRegularExpressionFlag.IGNORECASE: "i",
+        SigmaRegularExpressionFlag.MULTILINE: "m",
+        SigmaRegularExpressionFlag.DOTALL: "s",
+    }
+
+    # Case sensitive string matching expression. String is quoted/escaped like a normal string.
+    # Placeholders {field} and {value} are replaced with field name and quoted/escaped string.
+    case_sensitive_match_expression: ClassVar[str] = "{field} = {value}"
+    case_sensitive_startswith_expression: ClassVar[str] = "{field} starts with {value}"
+    case_sensitive_endswith_expression: ClassVar[str] = "{field} ends with {value}"
+    case_sensitive_contains_expression: ClassVar[str] = "{field} contains {value}"
+
+    # CIDR expressions: define CIDR matching if backend has native support. Else pySigma expands
+    # CIDR values into string wildcard matches.
+    cidr_expression: ClassVar[Optional[str]] = None
+
+    # Numeric comparison operators
+    compare_op_expression: ClassVar[str] = "{field} {operator} {value}"
+    compare_operators: ClassVar[Dict[SigmaCompareExpression.CompareOperators, str]] = {
+        SigmaCompareExpression.CompareOperators.LT: "<",
+        SigmaCompareExpression.CompareOperators.LTE: "<=",
+        SigmaCompareExpression.CompareOperators.GT: ">",
+        SigmaCompareExpression.CompareOperators.GTE: ">=",
+    }
+
+    # Expression for comparing two event fields
+    field_equals_field_expression: ClassVar[Optional[str]] = None
+    field_equals_field_escaping_quoting: Tuple[bool, bool] = (True, True)
+
+    # Null/None expressions
+    field_null_expression: ClassVar[str] = "{field} is null"
+
+    # Field existence condition expressions.
+    field_exists_expression: ClassVar[str] = "{field} exists"
+    field_not_exists_expression: ClassVar[str] = "{field} not exists"
+
+    # Field value in list, e.g. "field in (value list)" or "field containsall (value list)"
+    convert_or_as_in: ClassVar[bool] = False
+    convert_and_as_in: ClassVar[bool] = False
+    in_expressions_allow_wildcards: ClassVar[bool] = False
+    field_in_list_expression: ClassVar[str] = "{field} {op} ({list})"
+    or_in_operator: ClassVar[str] = "in"
+    and_in_operator: ClassVar[str] = "in"
+    list_separator: ClassVar[str] = ", "
+
+    # Value not bound to a field
+    unbound_value_str_expression: ClassVar[str] = "{value}"
+    unbound_value_num_expression: ClassVar[str] = "{value}"
+    unbound_value_re_expression: ClassVar[str] = "{value}"
+
+    # Query finalization: appending and concatenating deferred query part
+    deferred_start: ClassVar[str] = "\n| "
+    deferred_separator: ClassVar[str] = "\n| "
+    deferred_only_query: ClassVar[str] = "*"
+
+    correlation_methods: ClassVar[Dict[str, str]] = {
+        "default": "Test correlation method",
+    }
+    default_correlation_method: ClassVar[str] = "default"
+    default_correlation_query: ClassVar[str] = {"default": "{search}\n{aggregate}\n{condition}"}
+    temporal_correlation_query: ClassVar[str] = {"default": "{search}\n\n{aggregate}\n\n{condition}"}
+
+    correlation_search_single_rule_expression: ClassVar[str] = "{query}"
+    correlation_search_multi_rule_expression: ClassVar[str] = "{queries}"
+    correlation_search_multi_rule_query_expression: ClassVar[
+        str
+    ] = 'subsearch (( {query} | set event_type="{ruleid}"{normalization} ))'
+    correlation_search_multi_rule_query_expression_joiner: ClassVar[str] = "\n"
+
+    correlation_search_field_normalization_expression: ClassVar[str] = " | set {alias}={field}"
+    correlation_search_field_normalization_expression_joiner: ClassVar[str] = ""
+
+    event_count_aggregation_expression: ClassVar[Dict[str, str]] = {
+        "default": "| aggregate window={timespan} count() as event_count{groupby}"
+    }
+    value_count_aggregation_expression: ClassVar[Dict[str, str]] = {
+        "default": "| aggregate window={timespan} value_count({field}) as value_count{groupby}"
+    }
+    temporal_aggregation_expression: ClassVar[Dict[str, str]] = {
+        "default": "| temporal window={timespan} eventtypes={referenced_rules}{groupby}"
+    }
+    temporal_ordered_aggregation_expression: ClassVar[Dict[str, str]] = {
+        "default": "| temporal ordered=true window={timespan} eventtypes={referenced_rules}{groupby}"
+    }
+
+    timespan_mapping: ClassVar[Dict[str, str]] = {
+        "m": "min",
+    }
+    referenced_rules_expression: ClassVar[Dict[str, str]] = {"default": "{ruleid}"}
+    referenced_rules_expression_joiner: ClassVar[Dict[str, str]] = {"default": ","}
+
+    groupby_expression: ClassVar[Dict[str, str]] = {"default": " by {fields}"}
+    groupby_field_expression: ClassVar[Dict[str, str]] = {"default": "{field}"}
+    groupby_field_expression_joiner: ClassVar[Dict[str, str]] = {"default": ", "}
+
+    event_count_condition_expression: ClassVar[Dict[str, str]] = {
+        "default": "| where event_count {op} {count}"
+    }
+    value_count_condition_expression: ClassVar[Dict[str, str]] = {
+        "default": "| where value_count {op} {count}"
+    }
+    temporal_condition_expression: ClassVar[Dict[str, str]] = {
+        "default": "| where eventtype_count {op} {count}"
+    }
+    temporal_ordered_condition_expression: ClassVar[Dict[str, str]] = {
+        "default": "| where eventtype_count {op} {count} and eventtype_order={referenced_rules}"
+    }
+    ### Correlation end ###
+
+    @staticmethod
+    def _extract_mitre_technique_ids(rule: SigmaRule) -> List[str]:
+        technique_ids: List[str] = []
+        for tag in rule.tags or []:
+            tag_value = str(tag).lower()
+            if not tag_value.startswith("attack.t"):
+                continue
+            technique_id = tag_value.split(".", 1)[1].upper()
+            technique_ids.append(technique_id)
+        return technique_ids
+
+    @staticmethod
+    def _extract_mitre_tactics(rule: SigmaRule) -> List[str]:
+        tactics: List[str] = []
+        for tag in rule.tags or []:
+            tag_value = str(tag).lower()
+            if not tag_value.startswith("attack."):
+                continue
+            attack_tag = tag_value.split(".", 1)[1]
+            # Tactics are ATT&CK tags like "attack.execution", not technique IDs.
+            if attack_tag.startswith("t"):
+                continue
+            if attack_tag not in tactics:
+                tactics.append(attack_tag)
+        return tactics
+
+    def finalize_query_json(
+        self,
+        rule: Union[SigmaRule, SigmaCorrelationRule],
+        query: str,
+        index: int,
+        state: ConversionState,
+    ) -> Dict[str, Any]:
+        if isinstance(rule, SigmaCorrelationRule):
+            return {
+                "name": rule.name or "",
+                "description": "",
+                "status": "",
+                "level": "",
+                "text": query,
+                "platforms": [],
+                "date": "",
+                "modified": "",
+                "author": "",
+                "reference": [],
+                "falsepositives": [],
+                "mitreAttack": {
+                    "technique_ids": [],
+                    "tactics": [],
+                },
+            }
+
+        platforms: List[str] = []
+        if rule.logsource is not None:
+            for value in (rule.logsource.product, rule.logsource.service):
+                if value:
+                    platforms.append(value)
+
+        return {
+            "name": rule.title or "",
+            "description": str(getattr(rule, "description", "") or ""),
+            "status": str(getattr(rule, "status", "") or ""),
+            "level": str(getattr(rule, "level", "") or ""),
+            "text": query,
+            "platforms": platforms,
+            "date": str(getattr(rule, "date", "") or ""),
+            "modified": str(getattr(rule, "modified", "") or ""),
+            "author": str(getattr(rule, "author", "") or ""),
+            "reference": [str(reference) for reference in (rule.references or [])],
+            "falsepositives": [
+                str(falsepositive) for falsepositive in (rule.falsepositives or [])
+            ],
+            "mitreAttack": {
+                "technique_ids": self._extract_mitre_technique_ids(rule),
+                "tactics": self._extract_mitre_tactics(rule),
+            },
+        }
+
+    def finalize_output_json(self, queries: List[Dict[str, Any]]) -> str:
+        return json.dumps(queries, indent=2)
+
+
+# Backward-compatible alias for existing imports.
+signalsBackend = SignalsBackend
+

pysigma_backend_signals-0.1.0/sigma/pipelines/signals/__init__.py

@@ -0,0 +1 @@
+from .signals import signals_pipeline

pysigma_backend_signals-0.1.0/sigma/pipelines/signals/mappings.py

@@ -0,0 +1,157 @@
+from sigma.pipelines.common import (
+    logsource_linux_file_create,
+    logsource_linux_network_connection,
+    logsource_linux_process_creation,
+    logsource_macos_file_create,
+    logsource_macos_process_creation,
+    logsource_windows_file_event,
+    logsource_windows_image_load,
+    logsource_windows_network_connection,
+    logsource_windows_process_creation,
+    logsource_windows_registry_event,
+    logsource_windows_registry_set,
+)
+
+# Future logsource helpers we may enable later:
+# from sigma.pipelines.common import (
+#     logsource_windows_file_access,
+#     logsource_windows_file_change,
+#     logsource_windows_file_delete,
+#     logsource_windows_file_rename,
+#     logsource_windows_registry_add,
+#     logsource_windows_registry_delete,
+# )
+
+# Rule categories -> rule conditions
+CATEGORY_TO_CONDITIONS_MAPPINGS = {
+    "windows_process_creation": logsource_windows_process_creation(),
+    "windows_image_load": logsource_windows_image_load(),
+    "windows_file_event": logsource_windows_file_event(),
+    "windows_network_connection": logsource_windows_network_connection(),
+    "windows_registry_event": logsource_windows_registry_event(),
+    "windows_registry_set": logsource_windows_registry_set(),
+    "linux_process_creation": logsource_linux_process_creation(),
+    "linux_network_connection": logsource_linux_network_connection(),
+    "linux_file_create": logsource_linux_file_create(),
+    "macos_process_creation": logsource_macos_process_creation(),
+    "macos_file_create": logsource_macos_file_create(),
+}
+
+# Generic mappings that apply to all rule categories.
+GENERIC_FIELD_MAPPINGS = {
+    "User": "user.name",
+    "UserName": "user.name",
+    "LogonId": "user.logon_id",
+}
+
+# Rule category -> field mappings
+CATEGORY_FIELD_MAPPINGS = {
+    "windows_process_creation": {
+        "Image": "process.path",
+        "ProcessName": "process.name",
+        "CommandLine": "process.command_line",
+        "ParentImage": "process.parent.path",
+        "ParentProcessName": "process.parent.name",
+        "ParentCommandLine": "process.parent.command_line",
+        "CurrentDirectory": "process.working_directory",
+        "IntegrityLevel": "process.integrity_level",
+        "sha256": "process.hash.sha256",
+        "sha1": "process.hash.sha1",
+        "md5": "process.hash.md5",
+    },
+    "windows_image_load": {
+        "Image": "process.path",
+        "ImageLoaded": "module.path",
+        "ProcessName": "process.name",
+        "CommandLine": "process.command_line",
+        "sha256": "module.hash.sha256",
+        "sha1": "module.hash.sha1",
+        "md5": "module.hash.md5",
+    },
+    "windows_file_event": {
+        "Image": "process.path",
+        "TargetFilename": "file.path",
+        "FileName": "file.name",
+        "sha256": "file.hash.sha256",
+        "sha1": "file.hash.sha1",
+        "md5": "file.hash.md5",
+    },
+    "windows_network_connection": {
+        "Image": "process.path",
+        "ProcessName": "process.name",
+        "CommandLine": "process.command_line",
+        "Protocol": "network.protocol",
+        "SourceIp": "network.source.ip",
+        "SourcePort": "network.source.port",
+        "DestinationIp": "network.destination.ip",
+        "DestinationPort": "network.destination.port",
+        "DestinationHostname": "network.destination.domain",
+    },
+    "windows_registry_event": {
+        "Image": "process.path",
+        "TargetObject": "registry.key.path",
+        "RegistryKey": "registry.key.path",
+        "RegistryValueName": "registry.value.name",
+        "RegistryValueData": "registry.value.data",
+        "Details": "registry.value.data",
+    },
+    "windows_registry_set": {
+        "Image": "process.path",
+        "TargetObject": "registry.key.path",
+        "RegistryKey": "registry.key.path",
+        "RegistryValueName": "registry.value.name",
+        "RegistryValueData": "registry.value.data",
+        "Details": "registry.value.data",
+    },
+    "linux_process_creation": {
+        "Image": "process.path",
+        "ProcessName": "process.name",
+        "CommandLine": "process.command_line",
+        "ParentImage": "process.parent.path",
+        "ParentProcessName": "process.parent.name",
+        "ParentCommandLine": "process.parent.command_line",
+        "CurrentDirectory": "process.working_directory",
+        "sha256": "process.hash.sha256",
+        "sha1": "process.hash.sha1",
+        "md5": "process.hash.md5",
+    },
+    "linux_network_connection": {
+        "Image": "process.path",
+        "ProcessName": "process.name",
+        "CommandLine": "process.command_line",
+        "Protocol": "network.protocol",
+        "SourceIp": "network.source.ip",
+        "SourcePort": "network.source.port",
+        "DestinationIp": "network.destination.ip",
+        "DestinationPort": "network.destination.port",
+        "DestinationHostname": "network.destination.domain",
+    },
+    "linux_file_create": {
+        "Image": "process.path",
+        "TargetFilename": "file.path",
+        "FileName": "file.name",
+        "sha256": "file.hash.sha256",
+        "sha1": "file.hash.sha1",
+        "md5": "file.hash.md5",
+    },
+    "macos_process_creation": {
+        "Image": "process.path",
+        "ProcessName": "process.name",
+        "CommandLine": "process.command_line",
+        "ParentImage": "process.parent.path",
+        "ParentProcessName": "process.parent.name",
+        "ParentCommandLine": "process.parent.command_line",
+        "CurrentDirectory": "process.working_directory",
+        "sha256": "process.hash.sha256",
+        "sha1": "process.hash.sha1",
+        "md5": "process.hash.md5",
+    },
+    "macos_file_create": {
+        "Image": "process.path",
+        "TargetFilename": "file.path",
+        "FileName": "file.name",
+        "sha256": "file.hash.sha256",
+        "sha1": "file.hash.sha1",
+        "md5": "file.hash.md5",
+    },
+}

pysigma_backend_signals-0.1.0/sigma/pipelines/signals/signals.py

@@ -0,0 +1,49 @@
+from sigma.pipelines.base import Pipeline
+from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline
+from sigma.processing.transformations import FieldMappingTransformation
+from sigma.pipelines.signals.mappings import (
+    CATEGORY_FIELD_MAPPINGS,
+    CATEGORY_TO_CONDITIONS_MAPPINGS,
+    GENERIC_FIELD_MAPPINGS,
+)
+
+# Future pipeline imports you may enable later:
+# from sigma.processing.conditions import (
+#     IncludeFieldCondition,
+#     ExcludeFieldCondition,
+#     RuleProcessingItemAppliedCondition,
+# )
+# from sigma.processing.postprocessing import EmbedQueryTransformation
+# from sigma.processing.pipeline import QueryPostprocessingItem
+# from sigma.processing.transformations import (
+#     AddConditionTransformation,
+#     DetectionItemFailureTransformation,
+#     RuleFailureTransformation,
+#     SetStateTransformation,
+# )
+
+
+@Pipeline
+def signals_pipeline() -> ProcessingPipeline:
+    items = [
+        ProcessingItem(
+            identifier="signals_base_field_mapping",
+            transformation=FieldMappingTransformation(GENERIC_FIELD_MAPPINGS),
+        )
+    ]
+
+    for category, field_mappings in CATEGORY_FIELD_MAPPINGS.items():
+        items.append(
+            ProcessingItem(
+                identifier=f"signals_field_mapping_{category}",
+                transformation=FieldMappingTransformation(field_mappings),
+                rule_conditions=[CATEGORY_TO_CONDITIONS_MAPPINGS[category]],
+            )
+        )
+
+    return ProcessingPipeline(
+        name="Tanium Signals field mapping",
+        allowed_backends=frozenset({"signals"}),
+        priority=20,
+        items=items,
+    )