# Implémentation de Sigma

**URL:** <https://discuss.elastic.co/t/implementation-de-sigma/295454>\
**Category:** Discussions en français\
**Created:** [January 26, 2022, 1:27pm UTC](https://discuss.elastic.co/t/implementation-de-sigma/295454 "2022-01-26T13:27:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lynow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lynow/32/98866_2.png) [@Lynow](https://discuss.elastic.co/u/Lynow)\
**Post date:** [January 26, 2022, 1:27pm UTC](https://discuss.elastic.co/t/implementation-de-sigma/295454/1 "2022-01-26T13:27:29Z")

</div>

Bonjour,

J'ai récemment configuré une architecture de surveillance, veille, réponse à incident via MISP, TheHive, Cortex, Wazuh, Elasticsearch et j'en passe.

Je souhaite que les adresses IP malveillantes notées dans Elasticsearch/Kibana soient envoyées à la suite TheHive/MISP.

Cependant, je n'ai pas compris comment configurer et installer Sigma afin qu'il puisse être utilisé en corrélation avec Elasticsearch.

J'ai installé le référentiel Sigma à partir de ce lien :

> **[GitHub - SigmaHQ/sigma: Generic Signature Format for SIEM Systems](https://github.com/SigmaHQ/sigma)**
>
> Generic Signature Format for SIEM Systems. Contribute to SigmaHQ/sigma development by creating an account on GitHub.

Dans la documentation, il est expliqué comment fonctionne les règles. Tout d'abord, j'aimerais comprendre comment configurer Sigma, notamment en indiquant l'adresse du serveur à laquelle il va devoir aller chercher les informations.

PS : Par spécification, je n'utiliserai pas Elastalert mais bien uniquement Sigma (et non le plugin UI)

Lynow

---

<div class="post-metadata">

**Author:** ![danisan](https://avatars.discourse-cdn.com/v4/letter/d/6f9a4e/32.png) [@danisan](https://discuss.elastic.co/u/danisan)\
**Post date:** [January 28, 2022, 6:43pm UTC](https://discuss.elastic.co/t/implementation-de-sigma/295454/2 "2022-01-28T18:43:03Z")

</div>

Hi,  
Sigma rules are not supported by Wazuh. The team is porting them to Wazuh rule format and they will be added in future releases.  
There are some scripts that should convert Sigma rules to Wazuh, notice that these are not official:  
[GitHub - SanWieb/sigWah: A Sigma to Wazuh / OSSEC converter including a generated Windows Sysmon ruleset](https://github.com/SanWieb/sigWah)  
[GitHub - theflakes/sigma\_to\_wazuh: Convert Sigma rules to Wazuh rules](https://github.com/theflakes/sigma_to_wazuh)  
[GitHub - sametsazak/sysmon: Sysmon and wazuh integration with Sigma sysmon rules [updated]](https://github.com/sametsazak/sysmon)  
I haven't been able to test them myself but perhaps you will find them useful.  
Regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2022, 6:43pm UTC](https://discuss.elastic.co/t/implementation-de-sigma/295454/3 "2022-02-25T18:43:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.