# Sigma detection rules pipeline
**URL:** https://discuss.elastic.co/t/sigma-detection-rules-pipeline/356381
**Category:** Elastic Security
**Tags:** detection-rules
**Created:** [March 28, 2024, 10:15am UTC](https://discuss.elastic.co/t/sigma-detection-rules-pipeline/356381 "2024-03-28T10:15:26Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@maan](https://discuss.elastic.co/u/maan)
#### Post date: [March 28, 2024, 10:15am UTC](https://discuss.elastic.co/t/sigma-detection-rules-pipeline/356381/1 "2024-03-28T10:15:26Z")
Hi,
Do anybody have a good pipeline to transform sigma([https://sigmahq.io/](https://sigmahq.io/)) detection rules to Elastic Security (Defend)? There where some resonable good examples for the old sigmac converter, but I haven't found any for pysigma. There is a inbuilt pipeline (ecs\_windows) that suites the Windows integration (winlogbeat use-case).. but it does not work well with Defend integration or for other none-windows endpoints.
I'm working on a python script automate rule updates on new sigma releases and it kind of works well, but there are some issues with the field mappings.
Best regards
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2024, 10:15am UTC](https://discuss.elastic.co/t/sigma-detection-rules-pipeline/356381/2 "2024-04-25T10:15:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.