Package: pySigma-backend-datadog
pySigma Datadog BackendOverviewThis repository contains the Datadog backend package (sigma.backends.datadog) for pySigma. This package contains the DatadogBackend class, which can be used to convert Sigma rules to Datadog rules and queries that will work withDatadog’s Log ManagementandDatadog's Cloud SIEMproducts.Further, this repository also adds thedatadog_pipelineas part of the sigma.pipelines.datadog package. This defines Datadog’s default log processing pipeline for Sigma rule conversion, which performs field mappings and contains error-handling logic.Output FormatDisclaimer: Users shouldalwaysverify the output of the conversion tool to ensure rule and query accuracy before using in their environment.The Datadog pySigma backend supports the following output format options:default: queries outputted using the Datadog Query Syntax to reflect a detection.Note: Queries using the default output will only reflect the detection of the rule. Users may want to add the a log source to speed up the query slightly.siem_rule: Rule that are converted from the Sigma format to a Datadog formatThesiem-ruleoutput format will convert a rule in Sigma format to the Datadog Detection Rule format which will have adefault type: log_detection, which indicates that the rule is a  security rule with athreshold detection methodindicated bydetectionMethod: thresholdin the rule output.Either output option can be used for log search, custom alerts, dashboards, and reporting.Supported Rule Types:Currently, the Datadog pySigma backend supports logs from the following sources which arecloud rules currently supported in the Sigma Rules Repository. Log sources were chosen based on support for existing Sigma Rules which can be specified in thelogsource.servicefield of a Sigma Rule. Please see thisReadMe.mdfrom SigmaHQ for example rules.AWS CloudTrailAzure Logs:Audit LogsSign-in Logs-Azure Activity LogsGoogle Cloud Audit LogsInstallationClonepysigma-datadog-backendrepositoryClone theSigma Rules RepositoryCreate and activate a Pythonvirtual environmentusing the following commands:python3 -m venv .venv
. .venv/bin/activateRunpip install sigma-cliand follow instructions in thesigma-cli repositoryInstall the datadog backendsigma plugin install datadogUsing thesigma-cli, run the following command to convert a Sigma rule to a Datadog Cloud SIEM rulesigma convert -t datadog ../../andrea.piazza/sigma/sigma/rules/cloud/aws -f siem_ruleRun this command to convert a Sigma rule into a Datadog Querysigma convert -t datadog ../../{your.user}/sigma/sigma/rules/cloud/awsUse a text editor to view the/scripts/local_pysigma_dd_conversion.py scriptwithin thepysigma-datadog-backendrepo. Modify thesigma_rules_to_convertlist to indicate the rules that should be converted using the path in your file system to the Sigma Rules Repository cloned in Step 1.As an example:To convertAWS Cloudtrail Disable Logging Sigma Rule,Azure Blocked Account Attempt Sigma Rule, andGCP Bucket Enumeration Sigma Ruleto Datadog Rules locally, modify thesigma_rules_to_convertList usingthis scriptwith the path from theSigma Rules Repositorycloned in step 2.sigma_rules_to_convert = [
  r"/Users/user.name/sigma/sigma/rules/cloud/aws/aws_cloudtrail_disable_logging.yml",
  r"/Users/user.name/sigma/sigma/rules/cloud/azure/azure_blocked_account_attempt.yml",
  r"/Users/user.name/sigma/sigma/rules/cloud/gcp/gcp_bucket_enumeration.yml"
]Run the script with the commandpython3 scripts/local_pysigma_dd_conversion.pywhich will output either a Datadog query using thedefaultoutput, or a Datadog Cloud SIEM detection rule using thesiem_ruleoutput.Importing Sigma Rules to Datadog:The pipeline for the Datadog pySigma Backend converts fields from Sigma Rules into predefinedlog facets.  The current field mappings can be found in each Processing Item for the corresponding log source in theDatadog pySigma Pipeline.If a field is not listed in the pipeline, the field will automatically be prefixed with an@sign and the detection engineer should update the field mappings in the query match what’s in their environment. This is also true for queries generated using the default output.To check field mappings in the Datadog UI:Hover over “Logs” and click “Configuration”.Search for logsource that you're looking for field mappingsClick the expand the arrow next to value in the “Pipeline Name” columnThe “Remapper” rows define how fields from each log source gets mapped to Datadog facets.To create a new Detection Rule from a converted Sigma rule, make  aPOSTrequest to/api/v2/security_monitoring/rulesvia theDatadog API.MaintainersDatadog Cloud SIEM | Email:team-cloudsiembackend@datadoghq.comLimitationsTheDatadog Query Syntaxdoes not currently support Sigma Rules that useRegEx modifersThe following field on a Sigma Rule containing a modifier would throw an error using the Datadog Backend Conversion tool:selection:
  field|re: "reg.*ex"We currently do not support importing Sigma rules using the Datadog UI.