Registry / security / pysigma-backend-elasticsearch

pysigma-backend-elasticsearch

JSON →
library2.0.3pypypiunverified

This library provides the Elasticsearch backend for pySigma, converting Sigma rules into Lucene, ES|QL (including correlations), and EQL queries. It supports Elasticsearch versions 7.x and 8.x, with the latest version 2.0.3 requiring Python >=3.10. Release cadence follows Sigma specification updates and Elasticsearch query language changes.

security
pip install pysigma-backend-elasticsearch
INSTALL
IMPORT
SIG · PYSIGMA-BACKEND-EL
P
pysigma-backend-elasticsearch
securitypythonv2.0.3
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

ElasticsearchBackend
✓ from sigma.backends.elasticsearch import ElasticsearchBackend
✗ from pysigma.backends.elasticsearch import ElasticsearchBackend

Convert a simple Sigma rule into an Elasticsearch Lucene query using the default backend.

from pysigma import SigmaCollection from pysigma.backends.elasticsearch import ElasticsearchBackend rule = SigmaCollection.from_yaml(''' title: Test Rule status: test logsource: category: process_creation product: windows detection: selection: EventID: 4688 condition: selection ''') backend = ElasticsearchBackend() queries = backend.convert(rule) for query in queries: print(query.query_expression)
Debug
Known issues
breakingThe pySigma rule processing pipeline changed in Python 3.10+: the `condition` field must be explicit.
fix
Ensure every detection has an explicit `condition: selection` or similar, not just the rule body.
affects: >=2.0.0
deprecatedUsing `pysigma_backend_elasticsearch` as the import path is deprecated since v2.0.0.
fix
Use `from pysigma.backends.elasticsearch import ElasticsearchBackend`.
affects: >=2.0.0
gotchaWhen generating ES|QL queries, correlations require the `pysigma-correlation-rules` package, but it's an optional dependency not installed by default.
fix
Install with `pip install pysigma-backend-elasticsearch[correlation]` or separately `pip install pysigma-correlation-rules`.
affects: >=1.1.0
Upgrade
Version history
2.0.3latest on PyPI · released May 20, 2026
Audit
Dependencies
pysigmarequiredCore library for Sigma rule processing
pysigma-correlation-rulesoptionalRequired for ES|QL correlation queries
Agent activity
16 hits · last 30 days
node
14
OpenAI (training)
1
Resources

No resource links recorded.

pysigma-backend-elasticsearch — pip install pysigma-backend-elasticsearch · libregistry