Custom Sigma rules fail due to EQL conversion

[kspringer-maf]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

32

Storage for /

lots

Storage for /nsm

lots

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I have been working extensively over a period of days with Copilot, ChatGPT, and Grok to get a simple Sigma detection rule created and working and to educate myself on how these things work. After a lot of testing I've determined that Sigma rules are being auto converted to EQL language, and fail due to EQL's limitations. KQL on the other hand works fine. This also seems to apply to many of the pre-loaded Emerging Threats sigma rules. If I 'Convert' and 'Test in Kibana' they fail in the Kibana 'Dev Tools> Console' because it's using EQL. But if I test from a Kibana dashboard using KQL I get lots of results.

Here's Grok's Summary of the issue.
SO’s Sigma rule converter generates EQL queries, which fail due to parsing errors, timeouts, and incompatibility with text fields like 'message'. The GUI’s 'Convert' and 'Test in Kibana' features (along with ElastAlert) uses these broken EQL queries, preventing custom Sigma rules from triggering alerts.

I have 2 questions:

1. Is this a known continuing issue? I've seen a few posts about similar things in the past year, but haven't seen any resolution.
2. Can we somehow define Custom Sigma rules to use KQL language instead of being auto converted to EQL?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

hey there!

Please share one of the custom sigma rules that you are having issues with so that I can troubleshoot further.

Also, it is not possible to convert to KQL - Sigma does not support that backend.

[kspringer-maf]

I've abandoned the Sigma workflow for my specific needs on this issue, and tried to do it with Suricata rules instead. I've had success with that.