Package: pySigma-backend-QRadar-AQL
PySigma QRadar AQLThis is the QRadar AQL backend forpySigmawhich parses and convertsSigmaRules into
QRadar queries in AQL. It consists of a backend and two pipelines as describes below.
The project is usingpySigma_QRadar_basesubmodule.BackendQRadarAQL: It provides the packagesigma.backends.QRadarAQLwith theQRadarAQLBackendclass.PipelinesFurther, it contains the following processing pipelines insigma.pipelines.QRadarAQL:QRadarAQL_fields_pipeline: Supports only theSigma fieldsin theField Mapping.QRadarAQL_payload_pipeline: UsesUTF8(payload)instead of fields unsupported by theField Mapping. For unsupported fields, the following value types are not supported–BooleanNullCIDRRegular ExpressionNumeric ComparisonInstallationPyPIpip install ibm-qradar-aqlSigma pluginSigma CLIinstallsigma-cliinstall with Sigma plugins:sigma plugin install ibm-qradar-aqlpySigmafromsigma.pluginsimportSigmaPluginDirectoryplugins=SigmaPluginDirectory.default_plugin_directory()plugins.get_plugin_by_id("ibm-qradar-aql").install()UsageConvert Sigma rules to AQL by usingibm-qradar-aqlas backend, and one ofqradar-aql-fieldsandqradar-aql-payloadas pipeline:Sigma CLIsigma convert -t ibm-qradar-aql -p <qradar-aql-fields | qradar-aql-payload> <rule path> -o <output file name>Input example:PLEASE NOTE: you should haveSigma rulesin your project to use the
following
commandsigma convert -t ibm-qradar-aql -p qradar-aql-payload rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml -o output_file.txtOutput example:['SELECT * FROM events WHERE devicetype=12 AND LOWER("Target Process Path") LIKE \'%\\keepass.exe\'']pySigmaInput example:fromsigma.collectionimportSigmaCollectionfromsigma.backends.QRadarAQLimportQRadarAQLBackendfromsigma.pipelines.QRadarAQLimportQRadarAQL_fields_pipeline,QRadarAQL_payload_pipelinepipeline=QRadarAQL_fields_pipeline# or QRadarAQL_payload_pipelinerule=SigmaCollection.from_yaml("""logsource:product: windowscategory: create_remote_threaddetection:selection:TargetImage|endswith: '\KeePass.exe'condition: selection""")print(QRadarAQLBackend(pipeline()).convert(rule)[0])Output example:SELECT * FROM events WHERE devicetype=12 AND LOWER("Target Process Path") LIKE '%\keepass.exe'DevelopThis project is usingpySigma_QRadar_basesubmodule.
After cloning the project, make sure to update the submodule from thesigmadirectory
by running:git submodule update --init --recursiveQRadar Content PacksProperties Dictionary(required)Windows Custom Properties(recommended)Linux Custom Properties(recommended)other properties you may find in theApp ExchangeMappingField MappingSigma fieldQRadar AQL fieldAccessListRule NameAccessMaskAccess MaskAccessesAccessesAppIDApplicationAppIdApplicationAppNameApplicationAttributeLDAPDisplayNameUsername, Account Name, Distinguished NameAttributeValueAttribute Old Value, Attribute New Valuec-useragentUser Agentcs-user-agentUser Agentcs-usernameUsernameCallTraceCall TraceCallerProcessNameProcess PathcipherTicket Encryption TypeCommandLineCommandcs-methodMethodDestinationHostnameDestination HostnameErrorCodeError CodeExceptionCodeError CodeEventIDEvent IDeventSourcedevicetypeFailureCodeError CodeFileNameFilenameFilenameFilenameGrantedAccessGranted AccessHashesCONCAT(MD5=, MD5 Hash , SHA1=, SHA1 Hash , SHA256=, SHA256 Hash , IMPHASH=, IMP HASH)HostApplicationProcess PathHostNameHostnameInitiatedInitiatedImageProcess Path, Process NameImageNameProcess NameImagePathProcess PathImphashIMP HashIntegrityLevelIntegrity LevelInterfaceUuidSource Interface UUIDLogonTypeLogon TypeMessageMessageNameFile PathObjectNameObject NameObjectTypeObject TypeOriginalFileNameFilenameParentCommandLineParent CommandParentImageParent Process PathParentProcessIdParent Process IDPathFile PathpathFile PathPayloadUTF8(payload)payloadUTF8(payload)PipeNamePipe NameProcessIdProcess IDProcessNameProcess NameProcessPathProcess PathSamAccountNameSAM Account NameServiceService NameServiceFileNameService FilenameServiceNameService NameShareNameShare NameSignedSignedStatusStatusStartAddressStart AddressTargetFilenameFilenameTargetImageTarget Process PathTargetObjectProcess Name, Target Process Name, Object NameTargetUserNameTarget UsernameTaskNameTask NameTicketEncryptionTypeTicket Encryption TypeUserNameUsernameUsernameUsernamemd5MD5 HashmethodMethodNewTargetUserNameTarget Usernamesha1SHA1 Hashsha256SHA256 HashSourceFilenamefilenameSourceImageSource Process PathUSERUsernameUserUsernameuserAgentUser Agentuser_agentUser AgenteventNameQIDNAME(qid)ImageLoadedCONCAT(file directory, /, filename)DestinationIpdestinationipDestPortdestinationportDestinationPortdestinationportdestination.portdestinationportdst_ipdestinationipdst_portdestinationportSourcePortsourceportsrc_ipsourceipc-uriURLc-uri-extensionURLc-uri-queryURLcs-uriURLcs-uri-queryURLcs-uri-stemURLproperties.messageMessageScriptBlockTextMessageuriURLa0Commanda1Commanda2Commanda3Commanda4Commanda5CommandLog-Source MappingSigma service mapping to QRadar AQL device typeSigma serviceQRadar AQL device type nameQRadar AQL device type idaaaBridgewaterAAA143apacheApache10auditdLinuxServer11authWindowsAuthServer12clamavLinuxServer11cloudtrailAmazonAWSCloudTrail347cronLinuxServer11exchangeMicrosoftExchange99gcp.auditGoogleCloudAudit449iisIIS13ldpNetScreenIDP17lsa-serverISA191microsoft365portalOffice365, Office365MessageTrace, Microsoft365Defender397, 452, 515oktaOktaIdentityManagement382powershellWindowsAuthServer12rdpLinuxServer, WindowsAuthServer11, 12smbclient-securityLinuxServer, WindowsAuthServer11, 12sshdLinuxServer11sudoLinuxServer11syslogLinuxServer, WindowsAuthServer11, 12sysmonWindowsAuthServer12taskschedulerLinuxServer, WindowsAuthServer11, 12threat_detectionSAPEnterpriseThreatDetection424windefendMicrosoftWindowsDefenderATP433wmiWindowsAuthServer12Sigma product mapping to QRadar AQL device typeSigma productQRadar AQL device type nameQRadar AQL device type idawsAmazonAWSCloudTrail, AWSSecurityHub, AmazonAWSNetworkFirewall, AmazonAWSALBAccessLogs, AmazonAWSWAF, AmazonAWSKubernetes, AmazonAWSRoute53, AmazonCloudFront, AWSVerifiedAccess347, 440, 456, 460, 501, 502, 507, 516, 519MicrosoftAzureMicrosoftAzure413ciscoPix, IOS, VpnConcentrator, CSA, IDS, FWSM, ASA, CatOS, ACS, Cisco, NAC, Series12000, Series6500, Series7600, SeriesCRS, SeriesISR, IronPort, Aironet, Wism, ACE, CiscoWirelessNCS, Nexus, CiscoWLC, CiscoCallManager, CiscoISE, CiscoCWS, CiscoStealthwatch, CiscoUmbrella, CiscoMeraki, CiscoAMP, CiscoFirepowerThreatDefense, CiscoDuo6, 20, 23, 26, 30, 31, 41, 56, 90, 94, 95, 113, 114, 115, 116, 117, 179, 182, 183, 194, 248, 250, 273, 274, 316, 419, 429, 431, 435, 437, 448, 508gcpGoogleGSuite, GoogleCloudAudit, GoogleCloudPlatformFirewall, GoogleCloudDNS442, 449, 455, 461huaweiSSeriesSwitch, ARSeriesRouter269, 283juniperNetScreenFirewall, NetScreenIDP, JuniperSA, NetScreenNSM, InfranetController, JuniperRouter, JuniperSBR, JuniperDX, JuniperMSeries, JuniperMXSeries, JuniperTSeries, JuniperEXSeries, JuniperSRX, Avt, SRC, JuniperAltorVGW, SecurityBinaryLogCollector, JuniperMykonosWebSecurity, JuniperWirelessLAN, JuniperDDoSSecure5, 17, 36, 45, 59, 64, 83, 111, 118, 122, 123, 139, 150, 168, 192, 235, 264, 290, 320, 344linuxLinuxServer11m365Office365397macosAppleOSX102oktaOktaIdentityManagement382sqlMicrosoftSQL101windowsWindowsAuthServer12Mapping ContributionPull requests are welcome. After updating the Mapping, please rungenerate_readme.pyfor updating the mapping tables in
the README file.Field Mapping:####field mapping from Sigma to AQLfield_mapping: mapping for fields with exact mach from Sigma to AQLhost_field_mapping: mapping for host fields- values with wildcards converts to CIDRunstructured_field_mapping: mapping for fields that their value is a substring of another field's value- equal sign ('=') will be replaced with 'LIKE' operatorunstructured_part_field_mapping: mapping for fields that are part of another field- equal sign ('=') will be replaced with 'LIKE' operator, and the value transforms to the form '{field}%{value}'Log-Source Mapping:####mapping from Sigma log source to AQL device type idaql_log_source_mapping: AQL mapping from
device type name to device type id –PLEASE DO NOT CHANGE THIS MAPPINGaql_service_mapping: mapping from Sigma
services to AQL device type idaql_product_mapping: mapping from Sigma products
to AQL device type idLicensepySigma-backend-QRadar-AQL is licensed under the MITLicense.MaintainersCyber Center of Excellence - IBM