pysigma-backend-parseable 0.1.0__py3-none-any.whl

pysigma_backend_parseable-0.1.0.dist-info/METADATA

@@ -0,0 +1,327 @@
+Metadata-Version: 2.5
+Name: pysigma-backend-parseable
+Version: 0.1.0
+Summary: pySigma backend for Parseable SQL queries
+Project-URL: Homepage, https://github.com/parseablehq/pySigma-backend-parseable
+Project-URL: Issues, https://github.com/parseablehq/pySigma-backend-parseable/issues
+Author: Parseable pySigma contributors
+License: MIT
+License-File: LICENSE
+Keywords: parseable,pysigma,security,sigma,sql
+Requires-Python: >=3.10
+Requires-Dist: pysigma<2,>=1.0.0
+Provides-Extra: test
+Requires-Dist: coverage[toml]>=7.8; extra == 'test'
+Requires-Dist: pytest-cov>=6.1; extra == 'test'
+Requires-Dist: pytest>=8.3; extra == 'test'
+Requires-Dist: ruff>=0.12; extra == 'test'
+Description-Content-Type: text/markdown
+
+# pySigma backend for Parseable
+
+Convert [Sigma](https://github.com/SigmaHQ/sigma) detection rules into SQL accepted by
+[Parseable](https://github.com/parseablehq/parseable).
+
+The backend generates SQL only. It does not create alerts, send queries, discover datasets,
+or infer how fields are stored in your Parseable instance.
+
+## Requirements
+
+- Python 3.10 or newer
+- pySigma 1.x
+- Parseable v3.2.1 or newer when executing generated CIDR queries
+- A Parseable dataset when executing the generated SQL
+
+## Installation
+
+The package is not yet published. Install it from a checkout:
+
+```bash
+python -m venv .venv
+source .venv/bin/activate
+python -m pip install -e .
+```
+
+For the `sigma` command-line interface:
+
+```bash
+python -m pip install sigma-cli
+```
+
+Confirm that the plugin is available:
+
+```bash
+sigma list targets
+sigma list pipelines parseable
+```
+
+## Quick start
+
+Convert a rule into a complete query:
+
+```bash
+sigma convert \
+  --target parseable \
+  --backend-option dataset=windows-events \
+  examples/powershell.yml
+```
+
+Example output:
+
+```sql
+SELECT "Image", "CommandLine", "User"
+FROM "windows-events"
+WHERE LOWER("Image") LIKE '%\\powershell.exe' ESCAPE '\'
+  AND LOWER("CommandLine") LIKE '%-encodedcommand%' ESCAPE '\'
+```
+
+The backend quotes dataset and column names, so dotted names such as `service.name` are
+rendered as one SQL identifier: `"service.name"`.
+
+### Python API
+
+```python
+from pathlib import Path
+
+from sigma.backends.parseable import ParseableBackend
+from sigma.collection import SigmaCollection
+
+rules = SigmaCollection.from_yaml(Path("rule.yml").read_text())
+backend = ParseableBackend(dataset="windows-events")
+
+for query in backend.convert(rules):
+    print(query)
+```
+
+`convert()` returns a list because a Sigma document may contain multiple rules or
+conditions.
+
+## Output formats
+
+The default format produces a complete query and requires a dataset:
+
+```bash
+sigma convert -t parseable -O dataset=windows-events rule.yml
+```
+
+```sql
+SELECT * FROM "windows-events" WHERE "EventID" = 4625
+```
+
+The `predicate` format produces only the condition for embedding in another query. It does
+not require a dataset:
+
+```bash
+sigma convert -t parseable -f predicate rule.yml
+```
+
+```sql
+"EventID" = 4625
+```
+
+## Backend options
+
+| Option                  | Default                       | Description                                                  |
+| ----------------------- | ----------------------------- | ------------------------------------------------------------ |
+| `dataset`               | none                          | Dataset in the `FROM` clause; required for default output    |
+| `limit`                 | none                          | Positive integer appended as `LIMIT`                         |
+| `default_search_fields` | `body,message,event.original` | Comma-separated columns searched by fieldless Sigma keywords |
+
+Example:
+
+```bash
+sigma convert \
+  -t parseable \
+  -O dataset=application-logs \
+  -O limit=500 \
+  -O default_search_fields=body,message,log \
+  rule.yml
+```
+
+Every configured search field must exist in the target dataset. DataFusion rejects a query
+that references a missing column.
+
+## Field mapping pipelines
+
+Sigma rules use abstract field names. Parseable queries must use the exact columns created
+at ingestion. Select the pipeline matching your stored event schema:
+
+| Pipeline           | Use when                                                              |
+| ------------------ | --------------------------------------------------------------------- |
+| `parseable_otlp`   | OTLP log attributes are stored as literal semantic-convention columns |
+| `parseable_ecs`    | Nested ECS documents are flattened by Parseable using underscores     |
+| `parseable_sysmon` | Events use native Sysmon fields                                       |
+
+### OpenTelemetry
+
+```bash
+sigma convert \
+  -t parseable \
+  -p parseable_otlp \
+  -O dataset=otel-events \
+  rule.yml
+```
+
+Representative mappings:
+
+| Sigma             | Parseable OTLP            |
+| ----------------- | ------------------------- |
+| `Image`           | `process.executable.path` |
+| `CommandLine`     | `process.command_line`    |
+| `ProcessId`       | `process.pid`             |
+| `ParentProcessId` | `process.parent_pid`      |
+| `SourceIp`        | `source.address`          |
+| `DestinationIp`   | `destination.address`     |
+| `DestinationPort` | `destination.port`        |
+| `TargetFilename`  | `file.path`               |
+| `QueryName`       | `dns.question.name`       |
+| `Computer`        | `host.name`               |
+
+Mappings are scoped by Sigma log source where field meaning changes. The pipeline does not
+invent fields without a standard OpenTelemetry equivalent.
+
+### ECS
+
+```bash
+sigma convert \
+  -t parseable \
+  -p parseable_ecs \
+  -O dataset=ecs-events \
+  rule.yml
+```
+
+Nested ECS input such as `{"source":{"ip":"192.0.2.1"}}` becomes the Parseable column
+`source_ip`.
+
+| Sigma            | Flattened ECS               |
+| ---------------- | --------------------------- |
+| `EventID`        | `event_code`                |
+| `Channel`        | `winlog_channel`            |
+| `Image`          | `process_executable`        |
+| `CommandLine`    | `process_command_line`      |
+| `ParentImage`    | `process_parent_executable` |
+| `User`           | `user_name`                 |
+| `SourceIp`       | `source_ip`                 |
+| `DestinationIp`  | `destination_ip`            |
+| `TargetFilename` | `file_path`                 |
+| `QueryName`      | `dns_question_name`         |
+
+Use a custom pipeline if your events contain literal dotted ECS keys or use different column
+names.
+
+### Sysmon
+
+```bash
+sigma convert \
+  -t parseable \
+  -p parseable_sysmon \
+  -O dataset=sysmon-events \
+  rule.yml
+```
+
+This pipeline retains native Sysmon fields and adds the appropriate `Channel` and `EventID`
+conditions for generic Windows log sources. For Sysmon normalized to nested ECS before
+ingestion, chain the pipelines:
+
+```bash
+sigma convert \
+  -t parseable \
+  -p parseable_sysmon \
+  -p parseable_ecs \
+  -O dataset=ecs-sysmon-events \
+  rule.yml
+```
+
+### Custom schemas
+
+Built-in pipelines cannot know organization-specific column names. Define a pySigma pipeline
+for the schema actually present in your dataset:
+
+```yaml
+name: My Parseable field mapping
+priority: 30
+allowed_backends:
+  - parseable
+transformations:
+  - id: organization_fields
+    type: field_name_mapping
+    mapping:
+      Image: exe_path
+      CommandLine: command
+      User: username
+      SourceIp: client_ip
+```
+
+```bash
+sigma convert \
+  -t parseable \
+  -p company-parseable.yml \
+  -O dataset=company-events \
+  rule.yml
+```
+
+Always compare generated columns with the Parseable dataset schema before deploying rules.
+
+## Supported Sigma features
+
+The backend supports:
+
+- Case-insensitive Sigma string matching and the `cased` modifier
+- `contains`, `startswith`, `endswith`, `exists`, `fieldref`, and comparison modifiers
+- Sigma `*` and `?` wildcards
+- String and numeric lists
+- Regular expressions bound to a field
+- Null checks and Boolean conditions
+- Fieldless string and numeric keyword searches
+- IPv4 and IPv6 CIDR expressions through Parseable's `ip_in_cidr` SQL function
+
+Unsupported constructs fail explicitly with `SigmaFeatureNotSupportedByBackendError`:
+
+- Sigma correlation rules
+- Timestamp-part modifiers such as `minute` and `hour`
+- Fieldless regular expressions
+
+CIDR conversion requires a Parseable deployment that provides `ip_in_cidr(ip, cidr)`. The
+function correctly parses IPv4 and IPv6 rather than approximating address ranges as text.
+
+## Placeholders
+
+Sigma placeholders such as `%Administrators%` are deployment-specific values. Resolve them
+with a processing pipeline before conversion:
+
+```bash
+sigma convert \
+  -t parseable \
+  -p examples/placeholder-pipeline.yml \
+  -O dataset=windows-events \
+  examples/placeholder-rule.yml
+```
+
+Do not replace unknown placeholders with wildcards; that changes the detection's meaning.
+
+## Development
+
+Install development dependencies and run local checks:
+
+```bash
+python -m pip install -e '.[test]'
+pytest tests -m 'not integration'
+ruff check .
+python -m build
+```
+
+Live tests require `PARSEABLE_URL`, `PARSEABLE_INGESTION_URL`, and `PARSEABLE_API_KEY`.
+They use fixture datasets and are intentionally excluded from the default test command:
+
+```bash
+pytest tests/integration -m integration
+```
+
+The GitHub Actions corpus job checks conversion against a pinned Sigma corpus. Detailed
+results and regression thresholds live in [`reports/`](reports/) rather than this README.
+Successful conversion means valid SQL was generated; it does not prove that a deployment has
+matching columns or representative data.
+
+## License
+
+MIT

pysigma_backend_parseable-0.1.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+sigma/backends/parseable/__init__.py,sha256=2bbzGrT_Bh4h2GdstDarL_3t-r095WPSr0S-X5L7cpA,72
+sigma/backends/parseable/parseable.py,sha256=zPXuSUGJF3BLD-e2_hySrzb942dzwupSVwNd-R96GnU,14465
+sigma/pipelines/parseable/__init__.py,sha256=54FY2hG-MsmuSaYr2PCD72DXrIYD_u9Kdy4yPNHQWj0,456
+sigma/pipelines/parseable/ecs.py,sha256=HOHg-6e8qnHQvPU89Jxc-cKTzcsB0_g6AGVQAdp1-4Q,4933
+sigma/pipelines/parseable/otlp.py,sha256=CsE9tDkfpjmnemC09xJbIf4xK3QG0Xm6dYWmfZ5UlaA,4575
+sigma/pipelines/parseable/sysmon.py,sha256=0gaE5BqRVnY-5Rpi8eWXBbB2LHUN1ZEyRoNkU8iA2c8,2017
+pysigma_backend_parseable-0.1.0.dist-info/METADATA,sha256=4p6GPyssSzC7nxD7Tb-_Hfh0SfpdhWWuOFGTnJUTL4s,9474
+pysigma_backend_parseable-0.1.0.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+pysigma_backend_parseable-0.1.0.dist-info/licenses/LICENSE,sha256=8LCWq38mm3iqMrEF6MqhTYvtESoOEomIv7Md-AlqV9Y,1087
+pysigma_backend_parseable-0.1.0.dist-info/RECORD,,

pysigma_backend_parseable-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.0
+Root-Is-Purelib: true
+Tag: py3-none-any

pysigma_backend_parseable-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Parseable pySigma contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sigma/backends/parseable/__init__.py

@@ -0,0 +1,3 @@
+from .parseable import ParseableBackend
+
+__all__ = ["ParseableBackend"]

sigma/backends/parseable/parseable.py

@@ -0,0 +1,342 @@
+"""Convert Sigma rules to SQL accepted by Parseable's DataFusion query engine."""
+
+from __future__ import annotations
+
+import re
+from typing import Any, ClassVar
+
+from sigma.conditions import (
+    ConditionAND,
+    ConditionFieldEqualsValueExpression,
+    ConditionItem,
+    ConditionNOT,
+    ConditionOR,
+    ConditionValueExpression,
+)
+from sigma.conversion.base import TextQueryBackend
+from sigma.conversion.deferred import DeferredQueryExpression
+from sigma.conversion.state import ConversionState
+from sigma.exceptions import SigmaConfigurationError, SigmaFeatureNotSupportedByBackendError
+from sigma.rule import SigmaRule
+from sigma.types import (
+    SigmaBool,
+    SigmaCasedString,
+    SigmaCIDRExpression,
+    SigmaCompareExpression,
+    SigmaNumber,
+    SigmaRegularExpression,
+    SigmaString,
+    SpecialChars,
+)
+
+
+class ParseableBackend(TextQueryBackend):
+    """Parseable SQL backend.
+
+    Backend owns SQL syntax only. Processing pipelines remain responsible for mapping
+    abstract Sigma fields to columns present in a particular Parseable dataset.
+    """
+
+    name: ClassVar[str] = "parseable"
+    formats: ClassVar[dict[str, str]] = {
+        "default": "Complete Parseable SQL query",
+        "predicate": "Parseable SQL WHERE predicate",
+    }
+    requires_pipeline: ClassVar[bool] = False
+    correlation_methods: ClassVar[None] = None
+
+    precedence: ClassVar[tuple[type[ConditionItem], type[ConditionItem], type[ConditionItem]]] = (
+        ConditionNOT,
+        ConditionAND,
+        ConditionOR,
+    )
+    parenthesize: ClassVar[bool] = True
+    group_expression: ClassVar[str] = "({expr})"
+    token_separator: ClassVar[str] = " "
+    or_token: ClassVar[str] = "OR"
+    and_token: ClassVar[str] = "AND"
+    not_token: ClassVar[str] = "NOT"
+
+    field_quote: ClassVar[str] = '"'
+    field_quote_pattern: ClassVar[None] = None  # Always quote identifiers.
+    field_escape: ClassVar[str] = '"'  # SQL identifier quote escapes by doubling.
+    field_escape_quote: ClassVar[bool] = True
+    field_escape_pattern: ClassVar[None] = None
+
+    str_quote: ClassVar[str] = "'"
+    escape_char: ClassVar[str] = "\\"
+    wildcard_multi: ClassVar[str] = "%"
+    wildcard_single: ClassVar[str] = "_"
+    add_escaped: ClassVar[str] = "%_"
+    filter_chars: ClassVar[str] = ""
+    bool_values: ClassVar[dict[bool, str]] = {True: "TRUE", False: "FALSE"}
+
+    eq_token: ClassVar[str] = " = "
+    eq_expression: ClassVar[str] = "LOWER({field}) = {value}"
+    startswith_expression: ClassVar[str] = "LOWER({field}) LIKE {value} ESCAPE '\\'"
+    endswith_expression: ClassVar[str] = "LOWER({field}) LIKE {value} ESCAPE '\\'"
+    contains_expression: ClassVar[str] = "LOWER({field}) LIKE {value} ESCAPE '\\'"
+    wildcard_match_expression: ClassVar[str] = "LOWER({field}) LIKE {value} ESCAPE '\\'"
+
+    case_sensitive_match_expression: ClassVar[str] = "{field} = {value}"
+    case_sensitive_startswith_expression: ClassVar[str] = "{field} LIKE {value} ESCAPE '\\'"
+    case_sensitive_endswith_expression: ClassVar[str] = "{field} LIKE {value} ESCAPE '\\'"
+    case_sensitive_contains_expression: ClassVar[str] = "{field} LIKE {value} ESCAPE '\\'"
+
+    re_expression: ClassVar[str] = "regexp_like({field}, '{regex}')"
+    re_escape_char: ClassVar[str] = "\\"
+    re_escape: ClassVar[tuple[str, ...]] = ("'",)
+    re_escape_escape_char: ClassVar[bool] = False
+    re_flag_prefix: ClassVar[bool] = True
+
+    field_null_expression: ClassVar[str] = "{field} IS NULL"
+    field_exists_expression: ClassVar[str] = "{field} IS NOT NULL"
+    field_not_exists_expression: ClassVar[str] = "{field} IS NULL"
+
+    field_equals_field_expression: ClassVar[str] = "LOWER({field1}) = LOWER({field2})"
+    field_equals_field_startswith_expression: ClassVar[str] = (
+        "starts_with(LOWER({field1}), LOWER({field2}))"
+    )
+    field_equals_field_endswith_expression: ClassVar[str] = (
+        "ends_with(LOWER({field1}), LOWER({field2}))"
+    )
+    field_equals_field_contains_expression: ClassVar[str] = (
+        "strpos(LOWER({field1}), LOWER({field2})) > 0"
+    )
+    field_equals_field_escaping_quoting: ClassVar[tuple[bool, bool]] = (True, True)
+
+    compare_op_expression: ClassVar[str] = "{field} {operator} {value}"
+    compare_operators: ClassVar[dict[SigmaCompareExpression.CompareOperators, str]] = {
+        SigmaCompareExpression.CompareOperators.LT: "<",
+        SigmaCompareExpression.CompareOperators.LTE: "<=",
+        SigmaCompareExpression.CompareOperators.GT: ">",
+        SigmaCompareExpression.CompareOperators.GTE: ">=",
+    }
+
+    convert_or_as_in: ClassVar[bool] = True
+    convert_and_as_in: ClassVar[bool] = False
+    in_expressions_allow_wildcards: ClassVar[bool] = False
+    field_in_list_expression: ClassVar[str] = "{field} {op} ({list})"
+    or_in_operator: ClassVar[str] = "IN"
+    list_separator: ClassVar[str] = ", "
+
+    cidr_expression: ClassVar[None] = None
+    deferred_start: ClassVar[None] = None
+    deferred_separator: ClassVar[None] = None
+    deferred_only_query: ClassVar[None] = None
+
+    _SAFE_INTEGER = re.compile(r"^(0|[1-9][0-9]*)$")
+
+    def __init__(
+        self,
+        processing_pipeline: Any = None,
+        collect_errors: bool = False,
+        **backend_options: Any,
+    ) -> None:
+        super().__init__(processing_pipeline, collect_errors, **backend_options)
+        dataset = backend_options.get("dataset")
+        self.dataset = str(dataset).strip() if dataset is not None else ""
+        self.limit = self._parse_limit(backend_options.get("limit"))
+        search_fields = backend_options.get("default_search_fields", "body,message,event.original")
+        if isinstance(search_fields, str):
+            search_fields = [field.strip() for field in search_fields.split(",")]
+        self.default_search_fields = [str(field) for field in search_fields if str(field).strip()]
+
+    @classmethod
+    def _parse_limit(cls, value: Any) -> int | None:
+        if value is None or value == "":
+            return None
+        text = str(value)
+        if not cls._SAFE_INTEGER.fullmatch(text) or int(text) < 1:
+            raise SigmaConfigurationError("Parseable limit must be a positive integer.")
+        return int(text)
+
+    @staticmethod
+    def _sql_string(value: str) -> str:
+        return "'" + value.replace("'", "''") + "'"
+
+    def _render_string(self, value: SigmaString, *, like: bool, cased: bool) -> str:
+        if like:
+            rendered = value.convert("\\", "%", "_", "\\%_", "")
+        else:
+            rendered = value.convert("", "%", "_", "", "")
+        if not cased:
+            rendered = rendered.casefold()
+        return self._sql_string(rendered)
+
+    def convert_condition_field_eq_val_str(
+        self, cond: ConditionFieldEqualsValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        value = cond.value
+        if not isinstance(value, SigmaString):
+            raise TypeError(f"Expected SigmaString, got {type(value)}")
+
+        field = self.escape_and_quote_field(cond.field)
+        if value.startswith(SpecialChars.WILDCARD_MULTI) and value.endswith(
+            SpecialChars.WILDCARD_MULTI
+        ):
+            expression, actual, like = self.contains_expression, value, True
+        elif value.endswith(SpecialChars.WILDCARD_MULTI):
+            expression, actual, like = self.startswith_expression, value, True
+        elif value.startswith(SpecialChars.WILDCARD_MULTI):
+            expression, actual, like = self.endswith_expression, value, True
+        elif value.contains_special():
+            expression, actual, like = self.wildcard_match_expression, value, True
+        else:
+            expression, actual, like = self.eq_expression, value, False
+
+        return expression.format(
+            field=field,
+            value=self._render_string(actual, like=like, cased=False),
+            backend=self,
+        )
+
+    def convert_condition_field_eq_val_str_case_sensitive(
+        self, cond: ConditionFieldEqualsValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        value = cond.value
+        if not isinstance(value, SigmaString):
+            raise TypeError(f"Expected SigmaString, got {type(value)}")
+        field = self.escape_and_quote_field(cond.field)
+
+        if value.startswith(SpecialChars.WILDCARD_MULTI) and value.endswith(
+            SpecialChars.WILDCARD_MULTI
+        ):
+            expression, like = self.case_sensitive_contains_expression, True
+        elif value.endswith(SpecialChars.WILDCARD_MULTI):
+            expression, like = self.case_sensitive_startswith_expression, True
+        elif value.startswith(SpecialChars.WILDCARD_MULTI):
+            expression, like = self.case_sensitive_endswith_expression, True
+        elif value.contains_special():
+            expression, like = "{field} LIKE {value} ESCAPE '\\'", True
+        else:
+            expression, like = self.case_sensitive_match_expression, False
+
+        return expression.format(
+            field=field,
+            value=self._render_string(value, like=like, cased=True),
+            backend=self,
+        )
+
+    def convert_condition_as_in_expression(
+        self, cond: ConditionOR | ConditionAND, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        first = cond.args[0]
+        field = self.escape_and_quote_field(first.field)
+        cased = isinstance(first.value, SigmaCasedString)
+        if isinstance(first.value, SigmaString) and not cased:
+            field = f"LOWER({field})"
+        values = self.list_separator.join(
+            self._render_in_value(arg.value, cased=cased) for arg in cond.args
+        )
+        return self.field_in_list_expression.format(field=field, op=self.or_in_operator, list=values)
+
+    def _render_in_value(self, value: Any, *, cased: bool) -> str:
+        if isinstance(value, SigmaString):
+            return self._render_string(value, like=False, cased=cased)
+        if isinstance(value, SigmaNumber):
+            return str(value.number)
+        if isinstance(value, SigmaBool):
+            return self.bool_values[value.boolean]
+        raise TypeError(f"Unsupported Parseable IN-list value: {type(value)}")
+
+    def convert_value_re(
+        self, value: SigmaRegularExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        # DataFusion uses SQL string literals around regexes. Preserve regex backslashes,
+        # but double apostrophes so regex content cannot terminate the literal.
+        return value.escape((), "\\", False, True).replace("'", "''")
+
+    def convert_condition_val_str(
+        self, cond: ConditionValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        if not isinstance(cond.value, SigmaString):
+            raise TypeError(f"Expected SigmaString, got {type(cond.value)}")
+        if not self.default_search_fields:
+            raise SigmaConfigurationError(
+                "Value-only Sigma keywords require default_search_fields."
+            )
+        value = cond.value
+        if not value.contains_special():
+            wrapped = SigmaString()
+            wrapped.s = [SpecialChars.WILDCARD_MULTI, *value.s, SpecialChars.WILDCARD_MULTI]
+        else:
+            wrapped = value
+        rendered = self._render_string(wrapped, like=True, cased=False)
+        return "(" + " OR ".join(
+            f"LOWER({self.escape_and_quote_field(field)}) LIKE {rendered} ESCAPE '\\'"
+            for field in self.default_search_fields
+        ) + ")"
+
+    @staticmethod
+    def _unsupported(feature: str, source: Any = None) -> None:
+        raise SigmaFeatureNotSupportedByBackendError(
+            f"Parseable backend does not support {feature}.", source=source
+        )
+
+    def convert_condition_field_eq_val_cidr(
+        self, cond: ConditionFieldEqualsValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        cidr = cond.value
+        if not isinstance(cidr, SigmaCIDRExpression):
+            raise TypeError(f"Expected SigmaCIDRExpression, got {type(cidr)}")
+        field = self.escape_and_quote_field(cond.field)
+        return f"ip_in_cidr({field}, {self._sql_string(str(cidr.network))})"
+
+    def convert_condition_field_eq_val_timestamp_part(
+        self, cond: ConditionFieldEqualsValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        self._unsupported("timestamp-part modifiers", cond.source)
+
+    def convert_condition_val_num(
+        self, cond: ConditionValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        if not self.default_search_fields:
+            raise SigmaConfigurationError(
+                "Value-only Sigma numeric keywords require default_search_fields."
+            )
+        value = str(cond.value)
+        pattern = f"(^|[^0-9.+-]){re.escape(value)}([^0-9.]|$)"
+        rendered = self._sql_string(pattern)
+        return "(" + " OR ".join(
+            f"regexp_like(CAST({self.escape_and_quote_field(field)} AS VARCHAR), {rendered})"
+            for field in self.default_search_fields
+        ) + ")"
+
+    def convert_condition_val_re(
+        self, cond: ConditionValueExpression, state: ConversionState
+    ) -> str | DeferredQueryExpression:
+        self._unsupported("unbound regular-expression searches", cond.source)
+
+    def convert_correlation_rule(
+        self,
+        rule: Any,
+        output_format: str | None = None,
+        method: str | None = None,
+        callback: Any = None,
+    ) -> list[Any]:
+        self._unsupported("Sigma correlation rules", getattr(rule, "source", None))
+
+    def finalize_query_default(
+        self, rule: SigmaRule, query: str, index: int, state: ConversionState
+    ) -> str:
+        if not self.dataset:
+            raise SigmaConfigurationError(
+                "Parseable dataset required. Pass -O dataset=<name>."
+            )
+        fields = rule.fields or ["*"]
+        selected = ", ".join(
+            field if field == "*" else self.escape_and_quote_field(field) for field in fields
+        )
+        sql = f"SELECT {selected} FROM {self.escape_and_quote_field(self.dataset)} WHERE {query}"
+        if self.limit is not None:
+            sql += f" LIMIT {self.limit}"
+        return sql
+
+    def finalize_query_predicate(
+        self, rule: SigmaRule, query: str, index: int, state: ConversionState
+    ) -> str:
+        return query
+
+    def finalize_output_predicate(self, queries: list[str]) -> list[str]:
+        return queries

sigma/pipelines/parseable/__init__.py

@@ -0,0 +1,17 @@
+"""Built-in schema mappings for the Parseable backend."""
+
+from .ecs import parseable_ecs_pipeline
+from .otlp import parseable_otlp_pipeline
+from .sysmon import parseable_sysmon_pipeline
+
+pipelines = {
+    "parseable_otlp": parseable_otlp_pipeline,
+    "parseable_ecs": parseable_ecs_pipeline,
+    "parseable_sysmon": parseable_sysmon_pipeline,
+}
+
+__all__ = [
+    "parseable_ecs_pipeline",
+    "parseable_otlp_pipeline",
+    "parseable_sysmon_pipeline",
+]

sigma/pipelines/parseable/ecs.py

@@ -0,0 +1,123 @@
+"""Mappings for nested Elastic Common Schema JSON flattened by Parseable."""
+
+from sigma.pipelines.common import generate_windows_logsource_items
+from sigma.processing.conditions import (
+    FieldNameProcessingItemAppliedCondition,
+    IncludeFieldCondition,
+    LogsourceCondition,
+)
+from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline
+from sigma.processing.transformations import (
+    AddFieldnamePrefixTransformation,
+    FieldMappingTransformation,
+)
+
+ECS_WINDOWS_FIELDS = {
+    "EventID": "event_code",
+    "Channel": "winlog_channel",
+    "Provider_Name": "winlog_provider_name",
+    "Computer": "host_name",
+    "ComputerName": "winlog_computer_name",
+    "ProcessGuid": "process_entity_id",
+    "ProcessId": "process_pid",
+    "Image": "process_executable",
+    "CommandLine": "process_command_line",
+    "CurrentDirectory": "process_working_directory",
+    "ParentProcessGuid": "process_parent_entity_id",
+    "ParentProcessId": "process_parent_pid",
+    "ParentImage": "process_parent_executable",
+    "ParentCommandLine": "process_parent_command_line",
+    "FileVersion": "process_pe_file_version",
+    "Description": "process_pe_description",
+    "Product": "process_pe_product",
+    "Company": "process_pe_company",
+    "OriginalFileName": "process_pe_original_file_name",
+    "TargetFilename": "file_path",
+    "FileName": "file_path",
+    "ImageLoaded": "file_path",
+    "Device": "file_path",
+    "Signed": "file_code_signature_signed",
+    "Signature": "file_code_signature_subject_name",
+    "SignatureStatus": "file_code_signature_status",
+    "Imphash": "file_pe_imphash",
+    "SourceIp": "source_ip",
+    "SourceHostname": "source_domain",
+    "SourcePort": "source_port",
+    "SourceAddress": "source_ip",
+    "ClientAddress": "source_ip",
+    "ClientName": "source_domain",
+    "IpAddress": "source_ip",
+    "IpPort": "source_port",
+    "WorkstationName": "source_domain",
+    "DestinationIp": "destination_ip",
+    "DestinationHostname": "destination_domain",
+    "DestinationPort": "destination_port",
+    "DestinationPortName": "network_protocol",
+    "DestinationAddress": "destination_ip",
+    "DestAddress": "destination_ip",
+    "DestPort": "destination_port",
+    "Protocol": "network_transport",
+    "SourceProcessGuid": "process_entity_id",
+    "SourceProcessId": "process_pid",
+    "SourceImage": "process_executable",
+    "SourceThreadId": "process_thread_id",
+    "TargetObject": "registry_path",
+    "PipeName": "file_name",
+    "Destination": "process_executable",
+    "QueryName": "dns_question_name",
+    "QueryStatus": "sysmon_dns_status",
+    "IsExecutable": "sysmon_file_is_executable",
+    "Archived": "sysmon_file_archived",
+    "AccountDomain": "user_domain",
+    "AccountName": "user_name",
+    "SubjectDomainName": "user_domain",
+    "SubjectUserName": "user_name",
+    "SubjectUserSid": "user_id",
+    "TargetDomainName": "user_target_domain",
+    "TargetUserName": "user_target_name",
+    "TargetUserSid": "user_target_id",
+    "User": "user_name",
+    "NewProcessId": "process_pid",
+    "NewProcessName": "process_executable",
+    "ParentProcessName": "process_parent_executable",
+    "ProcessName": "process_executable",
+    "ScriptName": "file_path",
+    "SequenceNumber": "event_sequence",
+    "HostApplication": "process_command_line",
+    "HostId": "process_entity_id",
+    "HostName": "process_title",
+    "CommandName": "powershell_command_name",
+    "CommandPath": "powershell_command_path",
+    "CommandType": "powershell_command_type",
+    "ScriptBlockText": "powershell_file_script_block_text",
+    "ScriptBlockId": "powershell_file_script_block_id",
+    "Payload": "powershell_file_script_block_text",
+}
+
+
+def parseable_ecs_pipeline() -> ProcessingPipeline:
+    """Map Windows Sigma fields to Parseable-flattened ECS columns."""
+    return ProcessingPipeline(
+        name="Parseable flattened ECS Windows mappings",
+        priority=20,
+        allowed_backends=frozenset({"parseable"}),
+        items=generate_windows_logsource_items("winlog_channel", "{source}")
+        + [
+            ProcessingItem(
+                identifier="parseable_ecs_windows_fields",
+                transformation=FieldMappingTransformation(ECS_WINDOWS_FIELDS),
+                rule_conditions=[LogsourceCondition(product="windows")],
+            ),
+            ProcessingItem(
+                identifier="parseable_ecs_windows_event_data",
+                transformation=AddFieldnamePrefixTransformation("winlog_event_data_"),
+                field_name_conditions=[
+                    FieldNameProcessingItemAppliedCondition("parseable_ecs_windows_fields"),
+                    IncludeFieldCondition(fields=[r"\w+[._]\w+"], mode="re"),
+                ],
+                field_name_condition_negation=True,
+                field_name_condition_linking=any,
+                rule_conditions=[LogsourceCondition(product="windows")],
+            ),
+        ],
+    )

sigma/pipelines/parseable/otlp.py

@@ -0,0 +1,114 @@
+"""Mappings for OpenTelemetry semantic-convention attributes ingested through OTLP."""
+
+from sigma.processing.conditions import LogsourceCondition
+from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline
+from sigma.processing.transformations import FieldMappingTransformation
+
+PROCESS_CATEGORIES = (
+    "process_creation",
+    "process_termination",
+    "process_access",
+    "process_tampering",
+    "create_remote_thread",
+    "raw_access_thread",
+)
+NETWORK_CATEGORIES = ("network_connection", "firewall", "proxy")
+FILE_CATEGORIES = (
+    "file_access",
+    "file_change",
+    "file_create",
+    "file_delete",
+    "file_delete_detected",
+    "file_event",
+    "file_executable_detected",
+    "file_rename",
+    "image_load",
+)
+PROCESS_CONTEXT_CATEGORIES = tuple(
+    dict.fromkeys(PROCESS_CATEGORIES + NETWORK_CATEGORIES + FILE_CATEGORIES + ("dns_query",))
+)
+
+
+def _category_conditions(categories: tuple[str, ...]) -> list[LogsourceCondition]:
+    return [LogsourceCondition(category=category) for category in categories]
+
+
+def parseable_otlp_pipeline() -> ProcessingPipeline:
+    """Map Sigma taxonomy fields to literal OTel attributes stored by Parseable OTLP."""
+    return ProcessingPipeline(
+        name="Parseable OTLP semantic-convention mappings",
+        priority=20,
+        allowed_backends=frozenset({"parseable"}),
+        items=[
+            ProcessingItem(
+                identifier="parseable_otlp_host_fields",
+                transformation=FieldMappingTransformation(
+                    {
+                        "Computer": "host.name",
+                        "ComputerName": "host.name",
+                    }
+                ),
+            ),
+            ProcessingItem(
+                identifier="parseable_otlp_process_fields",
+                transformation=FieldMappingTransformation(
+                    {
+                        "Image": "process.executable.path",
+                        "ProcessName": "process.executable.path",
+                        "CommandLine": "process.command_line",
+                        "CurrentDirectory": "process.working_directory",
+                        "ProcessId": "process.pid",
+                        "ProcessID": "process.pid",
+                        "ParentProcessId": "process.parent_pid",
+                        "ParentProcessID": "process.parent_pid",
+                        "User": "process.owner",
+                    }
+                ),
+                rule_conditions=_category_conditions(PROCESS_CONTEXT_CATEGORIES),
+                rule_condition_linking=any,
+            ),
+            ProcessingItem(
+                identifier="parseable_otlp_network_fields",
+                transformation=FieldMappingTransformation(
+                    {
+                        "SourceIp": "source.address",
+                        "SourceIP": "source.address",
+                        "SourceAddress": "source.address",
+                        "SourceHostname": "source.address",
+                        "SourcePort": "source.port",
+                        "DestinationIp": "destination.address",
+                        "DestinationIP": "destination.address",
+                        "DestinationAddress": "destination.address",
+                        "DestinationHostname": "destination.address",
+                        "DestinationPort": "destination.port",
+                        "DestAddress": "destination.address",
+                        "DestPort": "destination.port",
+                        "Protocol": "network.transport",
+                    }
+                ),
+                rule_conditions=_category_conditions(NETWORK_CATEGORIES),
+                rule_condition_linking=any,
+            ),
+            ProcessingItem(
+                identifier="parseable_otlp_file_fields",
+                transformation=FieldMappingTransformation(
+                    {
+                        "TargetFilename": "file.path",
+                        "FileName": "file.path",
+                        "FilePath": "file.path",
+                    }
+                ),
+                rule_conditions=_category_conditions(FILE_CATEGORIES),
+                rule_condition_linking=any,
+            ),
+            ProcessingItem(
+                identifier="parseable_otlp_dns_fields",
+                transformation=FieldMappingTransformation(
+                    {
+                        "QueryName": "dns.question.name",
+                    }
+                ),
+                rule_conditions=[LogsourceCondition(category="dns_query")],
+            ),
+        ],
+    )

sigma/pipelines/parseable/sysmon.py

@@ -0,0 +1,61 @@
+"""Canonical generic Windows log-source mappings for native Sysmon events."""
+
+from sigma.processing.conditions import LogsourceCondition
+from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline
+from sigma.processing.transformations import AddConditionTransformation
+
+SYSMON_CHANNEL = "Microsoft-Windows-Sysmon/Operational"
+SYSMON_EVENT_IDS: dict[str, int | list[int]] = {
+    "process_creation": 1,
+    "file_change": 2,
+    "network_connection": 3,
+    "sysmon_status": [4, 16],
+    "process_termination": 5,
+    "driver_load": 6,
+    "image_load": 7,
+    "create_remote_thread": 8,
+    "raw_access_thread": 9,
+    "process_access": 10,
+    "file_event": 11,
+    "registry_add": 12,
+    "registry_delete": 12,
+    "registry_set": 13,
+    "registry_rename": 14,
+    "registry_event": [12, 13, 14],
+    "create_stream_hash": 15,
+    "pipe_created": [17, 18],
+    "wmi_event": [19, 20, 21],
+    "dns_query": 22,
+    "file_delete": 23,
+    "clipboard_capture": 24,
+    "process_tampering": 25,
+    "file_delete_detected": 26,
+    "file_block_executable": 27,
+    "file_block_shredding": 28,
+    "file_executable_detected": 29,
+    "sysmon_error": 255,
+}
+
+
+def parseable_sysmon_pipeline() -> ProcessingPipeline:
+    """Add native Sysmon channel and event IDs to generic Windows Sigma rules."""
+    return ProcessingPipeline(
+        name="Parseable native Sysmon log-source mappings",
+        priority=10,
+        allowed_backends=frozenset({"parseable"}),
+        items=[
+            ProcessingItem(
+                identifier=f"parseable_sysmon_{category}",
+                transformation=AddConditionTransformation(
+                    {
+                        "Channel": SYSMON_CHANNEL,
+                        "EventID": event_ids,
+                    }
+                ),
+                rule_conditions=[
+                    LogsourceCondition(product="windows", category=category)
+                ],
+            )
+            for category, event_ids in SYSMON_EVENT_IDS.items()
+        ],
+    )