The Sigma query frontend makes it possible to execute Sigma
rules in VAST. This means you can provide a
Sigma rule instead of a VAST expression when querying data.
vast export json < sigma-rule.yaml
Sigma defines a YAML-based rule language along with a compiler
that transforms rules into the native query languages of SIEM systems. VAST
takes a different approach and compiles the Sigma query directly into a native
query expression, without going through the Python tooling provided by the
SigmaHQ project. This has numerous advantages in exploiting the richer type
system of VAST. The translation process looks as follows:
The Sigma rule YAML format requires a detection attribute that includes a map
of named sub-expression called search identifiers. In addition, detection
must include a final condition that combines search identifiers using boolean
algebra (AND, OR, and NOT) or syntactic sugar to reference groups of search
expressions, e.g., using the 1/all of * or plain wildcard syntax.
Consider the following Sigma detection embedded in a rule:
detection: foo: a:42 b:"evil" bar: c: 22.214.171.124 condition: foo or not bar
VAST translates this rule piece by building a symbol table of all keys (foo
and bar). Each sub-expression is a valid VAST expression itself:
foo: a == 42 && b == "evil"
bar: c == 126.96.36.199
Finally, VAST combines the expression according to the condition:
(a ==42&& b =="evil")||!(c ==188.8.131.52)
Rich YAML Typing
Because VAST has a beefed up YAML parser that performs type inference, the YAML
snippet c: 184.108.40.206 is parsed as a key-value pair with types string and
address. This means that we get the rich type system of VAST for free.
Sigma comes with a taxonomy to
facilitate rule sharing by standardizing field names of the supported data
VAST currently does not ship with a taxonomy to transparently map the canonical
Sigma fields to an equivalent in VAST. We will ship the missing mappings in the
future. To date, you must either use VAST concepts to re-implement the mappings
or wait until we have provided them.
VAST and Sigma have many commonalities. They both support flexible construction
of search expressions using boolean algebra (AND, OR, NOT) and offer multiple
ways to define predicates and sub-expression. But there also exist differences
in expressiveness and intent. This section compares the two systems.
The majority of rule definitions include combinations of exact string lookups,
substring searches, or pattern matches. Sigma uses
to select a concrete operator for given search predicate. Without a modifier
specification, Sigma uses equality comparison (==) of field and value. For
example, the contains modifier changes the operator to substring search, and
the re modifier switches to a regular expression match. The now "legacy" sigma
compiler lacks support for ordering relationships, such as less-than comparison
of numerical values, e.g., x < 42 or timestamp >= 2021-02. The
pySigma project addresses this with the
additional modifiers lt, lte, gt, gte.