Repository: SigmaHQ/sigma

Issue:
Sigmac: Add Tags to Converted Rules
Hi there,

Using an example of the [High DNS Requests Rate rule](https://github.com/SigmaHQ/sigma/blob/master/rules/network/net_high_dns_requests_rate.yml), the tags which are found in the .yml file are seen in lines 12 to 18.

Using Sigmac with the `-t es-rule` parameter, the converted rule retains the same tags. Uploading this converted rule to Elastic Detections shows that this is indeed the case:

![image](https://user-images.githubusercontent.com/35021368/122317067-7a878580-cf4f-11eb-8733-9bffc6349457.png)

1. Would like to request / ask if there is a way to insert a `Sigma` tag to each rule that is converted using Sigmac?
In the Elastic scenario, there might be other rules converted to be custom rules to be imported into Elastic Detections. Filtering for these other rules (or on the contrary, if filtering for Sigma rules) cannot be easily done at the moment without such a tag to distinguish Sigma rules from other kinds of custom rules. The reason is because all imported rules are grouped under `Custom` rules.
2. Would also like to request / ask if there is a way to insert the category's name to each rule that is converted using Sigmac?
Using the rule above as an example, this would mean adding a `network` tag. Since there are 10 categories' worth of rules, this would mean 10 possible tags to choose from for each rule converted under Sigmac.

Thank you! 


Discussion:
Hi,

`python sigmac -t es-rule --backend-help es-rule`

```
python sigmac -t es-rule -c .\config\winlogbeat.yml --backend-option custom_tag=sigma ..\rules\network\net_apt_equationgroup_c2.yml
{"description": "Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools", 
"enabled": true, "false_positives": ["Unknown"], "filters": [], "from": "now-360s", "immutable": false, "index": ["winlogbeat-*"], "interval": "5m",
 "rule_id": "881834a4-6659-4773-821e-1c151789d873", "language": "lucene", "output_index": ".siem-signals-default", "max_signals": 100, "risk_score": 65, "name": "Equation Group C2 Communication", 
"query": "(winlog.event_data.DestinationIp:(\"69.42.98.86\" OR \"89.185.234.145\") OR winlog.event_data.SourceIp:(\"69.42.98.86\" OR \"89.185.234.145\"))", 
"meta": {"from": "1m"}, "severity": "high", 

"tags": ["sigma"],

 "to": "now", "type": "query", "threat": [], "version": 1, 
"references": ["https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation", "https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195"]}
```
I have to works to add more than 1 tag.


Resolving patch:
diff --git a/tools/sigma/backends/elasticsearch.py b/tools/sigma/backends/elasticsearch.py
--- a/tools/sigma/backends/elasticsearch.py
+++ b/tools/sigma/backends/elasticsearch.py
@@ -1341,7 +1341,7 @@ class ElasticSearchRuleBackend(object):
                 ("convert_to_url", False, "Want to convert to a URL ?", None),
                 ("path_to_replace", "../", "The local path to replace with dest_base_url", None),
                 ("dest_base_url", "https://github.com/SigmaHQ/sigma/tree/master/", "The URL prefix", None),
-                ("custom_tag", None , "Add a custom tag", None),
+                ("custom_tag", None , "Add custom tag. for multi split with a comma tag1,tag2 ", None),
             )
     default_rule_type = "query"
 
@@ -1499,7 +1499,12 @@ def create_rule(self, configs, index):
                         tactics_list.append(tact)
         
         if self.custom_tag:
-            new_tags.append(self.custom_tag)
+            if ',' in self.custom_tag:
+                tag_split = self.custom_tag.split(",")
+                for l_tag in tag_split:
+                    new_tags.append(l_tag)   
+            else:    
+                new_tags.append(self.custom_tag)
             
         threat = self.create_threat_description(tactics_list=tactics_list, techniques_list=technics_list)
         rule_name = configs.get("title", "").lower()


Test patch: