sigma rules on HELK

[nugnugrawk]

how to implementation and activation sigma rules on HELK ? can you give me tutorials about implementation sigma rules on HELK ? thank you

[Cyb3rWard0g]

Hey @nugnugrawk ! We are currently working on updating helk-elastalert to handle sigma rules for HELK.

[nugnugrawk]

Does this mean that currently the Sigma rule can't be used on the helk?

[Cyb3rWard0g]

Hey @nugnugrawk ! Sigma can be used directly in the Kibana interface if you translate the sigma rule to the right syntax. We use helk-elastalert to automate the execution of the query.

[Cyb3rWard0g]

You can use https://uncoder.io/ to do the translation

[Cyb3rWard0g]

One issue with that of course is that the translation uses ECS standardization. Make sure you use the right field names with HELK

[nugnugrawk]

You can use https://uncoder.io/ to do the translation

after translating the sigma rules to ECS like this, then how do you use them in HELK to appear on the elastalert_status?

[FrancescoFaenzi]

I see "after translating the sigma rules to ECS like this, then how do you use them in HELK to appear on the elastalert_status?" has not been answered. Can you recommend how to do this?

[neu5ron]

@FrancescoFaenzi add your sigma rule to the rules folder, or within the docker container by getting into via sudo docker exec -ti helk-elastalert bash