### Basic Sigma Rule to SPL Query Conversion

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Demonstrates fundamental Sigma rule conversion using the SplunkBackend class. Shows how to initialize the backend, load Sigma rules from YAML, and convert them to basic SPL queries. The example covers simple field-value matching with AND conditions.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

# Basic conversion with default settings
backend = SplunkBackend()

rule = SigmaCollection.from_yaml("""
title: Suspicious Process Execution
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA: valueA
        fieldB: valueB
    condition: sel
""")

result = backend.convert(rule)
# Output: ['fieldA="valueA" fieldB="valueB"']
```

--------------------------------

### Detect Web Proxy with CIM in Splunk - Python

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Shows converting web proxy Sigma rules to CIM-compliant Splunk tstats queries for web traffic analysis. Uses SplunkBackend with splunk_cim_data_model pipeline and SigmaCollection. Input YAML targets proxy category; output is a tstats query mapping fields like c-uri to Web.url. Requires CIM data model knowledge; may not work without proper Splunk CIM setup.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.pipelines.splunk import splunk_cim_data_model
from sigma.collection import SigmaCollection

backend = SplunkBackend(processing_pipeline=splunk_cim_data_model())

proxy_rule = SigmaCollection.from_yaml("""
title: Suspicious Web Traffic
status: test
logsource:
    category: proxy
detection:
    sel:
        c-uri: '*/admin/*'
        c-useragent: '*scanner*'
    condition: sel
""")

result = backend.convert(proxy_rule, "data_model")
# Output: tstats query against Web.Proxy data model
# Field mappings: c-uri -> Web.url, c-useragent -> Web.http_user_agent
```

--------------------------------

### Select Output Fields with Table in Splunk - Python

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

This example illustrates specifying fields for query results in Splunk using the fields attribute, generating SPL table commands. It requires SplunkBackend and SigmaCollection from sigma. The input YAML includes fields like fieldA; output appends | table with specified fields. Not all field combinations may optimize queries, and it assumes direct field name compatibility.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

backend = SplunkBackend()

rule = SigmaCollection.from_yaml("""
title: Selected Fields Output
status: test
logsource:
    category: test_category
    product: test_product
fields:
    - fieldA
    - fieldB
    - fieldC
detection:
    sel:
        fieldA: valueA
    condition: sel
""")

result = backend.convert(rule)
# Output: ['fieldA="valueA" | table fieldA,fieldB,fieldC']
```

--------------------------------

### Sysmon Acceleration Keywords for Splunk Queries

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Shows how the `splunk_windows_sysmon_acceleration_keywords` pipeline adds characteristic keywords to Sysmon queries for accelerating search performance in Splunk.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.pipelines.splunk import splunk_windows_sysmon_acceleration_keywords
from sigma.collection import SigmaCollection

# Acceleration pipeline adds keywords for faster searches
backend = SplunkBackend(
    processing_pipeline=splunk_windows_sysmon_acceleration_keywords()
)

rule = SigmaCollection.from_yaml("""
title: Sysmon Process Creation
status: test
logsource:
    category: process_creation
    product: windows
    service: sysmon
detection:
    sel:
        Image: '*\cmd.exe'
    condition: sel
""")

result = backend.convert(rule)
```

--------------------------------

### Regular Expression Handling with Deferred Execution

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Shows how the backend processes regular expressions by deferring them to SPL's regex or rex commands. Demonstrates proper query execution order when combining regex patterns with other field conditions. Important for complex pattern matching and data extraction scenarios.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

backend = SplunkBackend()

# Single regex with other fields
regex_rule = SigmaCollection.from_yaml("""
title: Test Regex
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA|re: foo.*bar
        fieldB: foo
        fieldC: bar
    condition: sel
""")

result = backend.convert(regex_rule)
# Output: ['fieldB="foo" fieldC="bar"\n| regex fieldA="foo.*bar"']
```

--------------------------------

### Custom Backend Configuration and Output Settings

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Shows advanced backend configuration with custom query settings and output formatting. Demonstrates how to configure savedsearches.conf format output with time ranges, custom metadata, and field selection. Useful for automated Splunk search deployment.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

# Custom backend with query settings
backend = SplunkBackend(
    query_settings=lambda rule: {"custom.query.key": rule.title},
    output_settings={"custom.key": "customvalue"},
    min_time="-7d",
    max_time="now"
)

rules = """
title: Test Rule
description: Detect suspicious activity
status: test
logsource:
    category: test_category
    product: test_product
fields:
    - fieldA
detection:
    sel:
        fieldA: foo
        fieldB: bar
    condition: sel
"""

result = backend.convert(SigmaCollection.from_yaml(rules), "savedsearches")
# Outputs savedsearches.conf format with custom settings:
# [default]
# dispatch.earliest_time = -7d
# dispatch.latest_time = now
# custom.key = customvalue
#
# [Test Rule]
# custom.query.key = Test Rule
# description = Detect suspicious activity
# search = fieldA="foo" fieldB="bar" | table fieldA
```

--------------------------------

### Windows Event Log Mapping to Splunk

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Illustrates the use of the `splunk_windows_pipeline` for mapping Sigma Windows log sources to Splunk WinEventLog source format and field name transformations.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.pipelines.splunk import splunk_windows_pipeline
from sigma.collection import SigmaCollection

# Use Windows pipeline for field mappings
backend = SplunkBackend(processing_pipeline=splunk_windows_pipeline())

rule = SigmaCollection.from_yaml("""
title: Windows Security Event
status: test
logsource:
    product: windows
    service: security
detection:
    sel:
        EventID: 4624
    condition: sel
""")

result = backend.convert(rule)
```

--------------------------------

### Field Reference and CIDR Queries in Splunk

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Shows how to implement field-to-field comparisons and CIDR network range matching within Sigma rules converted to Splunk queries.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

backend = SplunkBackend()

# Field reference - compare two fields
fieldref_rule = SigmaCollection.from_yaml("""
title: Field Comparison
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA|fieldref: fieldD
        fieldB: foo
    condition: sel
""")

result = backend.convert(fieldref_rule)
```

--------------------------------

### SplunkBackend with Custom Query Settings

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Configure the backend with custom query and output settings for savedsearches.conf format, including time ranges and additional metadata.

```APIDOC
## POST /splunk/convert/custom

### Description
Converts Sigma rules with custom query settings, including savedsearches.conf format, time ranges, and additional metadata.

### Method
POST

### Endpoint
/splunk/convert/custom

### Parameters
#### Request Body
- **rules** (object) - Required - The Sigma rules in YAML format to be converted.
- **query_settings** (object) - Optional - Custom query settings.
- **output_settings** (object) - Optional - Output settings for savedsearches.conf.
- **min_time** (string) - Optional - Earliest time for the search.
- **max_time** (string) - Optional - Latest time for the search.

### Request Example
{
  "title": "Test Rule",
  "description": "Detect suspicious activity",
  "status": "test",
  "logsource": {
    "category": "test_category",
    "product": "test_product"
  },
  "fields": ["fieldA"],
  "detection": {
    "sel": {
      "fieldA": "foo",
      "fieldB": "bar"
    },
    "condition": "sel"
  },
  "query_settings": {
    "custom.query.key": "Test Rule"
  },
  "output_settings": {
    "custom.key": "customvalue"
  },
  "min_time": "-7d",
  "max_time": "now"
}

### Response
#### Success Response (200)
- **savedsearches** (string) - The savedsearches.conf formatted output.

#### Response Example
{
  "savedsearches": "[default]\ndispatch.earliest_time = -7d\ndispatch.latest_time = now\ncustom.key = customvalue\n\n[Test Rule]\ncustom.query.key = Test Rule\ndescription = Detect suspicious activity\nsearch = fieldA=\"foo\" fieldB=\"bar\" | table fieldA"
}
```

--------------------------------

### CIM Data Model Query Generation for Splunk

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Demonstrates the `splunk_cim_data_model` pipeline, which converts Sigma rules to Splunk tstats queries using the Common Information Model (CIM).

```python
from sigma.backends.splunk import SplunkBackend
from sigma.pipelines.splunk import splunk_cim_data_model
from sigma.collection import SigmaCollection

# CIM pipeline for process creation events
backend = SplunkBackend(processing_pipeline=splunk_cim_data_model())

process_rule = SigmaCollection.from_yaml("""
title: Suspicious Command Line
status: test
logsource:
    category: process_creation
    product: windows
detection:
    sel:
        CommandLine: whoami
        Image: '*\cmd.exe'
    condition: sel
""")

result = backend.convert(process_rule, "data_model")

registry_rule = SigmaCollection.from_yaml("""
title: Registry Modification
status: test
logsource:
    category: registry_set
    product: windows
detection:
    sel:
        TargetObject: '*\Software\Microsoft\Windows\CurrentVersion\Run\*'
    condition: sel
""")

result = backend.convert(registry_rule, "data_model")
```

--------------------------------

### SplunkBackend - Convert Sigma Rules to SPL Queries

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

The SplunkBackend class is the main interface for converting Sigma detection rules into Splunk queries. It handles field mappings, logical operators, and output formatting.

```APIDOC
## POST /splunk/convert

### Description
Converts Sigma detection rules into Splunk Search Processing Language (SPL) queries using the default settings.

### Method
POST

### Endpoint
/splunk/convert

### Parameters
#### Request Body
- **rule** (object) - Required - The Sigma rule in YAML format to be converted.

### Request Example
{
  "title": "Suspicious Process Execution",
  "status": "test",
  "logsource": {
    "category": "test_category",
    "product": "test_product"
  },
  "detection": {
    "sel": {
      "fieldA": "valueA",
      "fieldB": "valueB"
    },
    "condition": "sel"
  }
}

### Response
#### Success Response (200)
- **queries** (array) - Array of converted SPL queries.

#### Response Example
{
  "queries": ["fieldA=\"valueA\" fieldB=\"valueB\""]
}
```

--------------------------------

### Convert CIDR IP Ranges to Splunk - Python

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

This snippet demonstrates converting Sigma rules with CIDR notations for IP ranges into Splunk SPL queries using the SplunkBackend. It relies on the sigma Python library for SigmaCollection and backend conversion. The input is a YAML-defined Sigma rule, and output is a list of SPL search strings; note that it assumes a test logsource and may not handle real-world CIDR complexities beyond /16 and /8.

```python
from sigma.collection import SigmaCollection

cidr_rule = SigmaCollection.from_yaml("""
title: Network Range Detection
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA|cidr:
            - 192.168.0.0/16
            - 10.0.0.0/8
        fieldB: suspicious
    condition: sel
""")

result = backend.convert(cidr_rule)
# Output: ['fieldA="192.168.0.0/16" OR fieldA="10.0.0.0/8" fieldB="suspicious"']
```

--------------------------------

### Regular Expression Handling with Deferred Execution

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Handles regular expressions by deferring them to SPL's regex or rex commands, ensuring proper query execution order.

```APIDOC
## POST /splunk/convert/regex

### Description
Converts Sigma rules with regular expressions, deferring them to SPL's regex or rex commands for proper execution order.

### Method
POST

### Endpoint
/splunk/convert/regex

### Parameters
#### Request Body
- **rule** (object) - Required - The Sigma rule with regex expressions to be converted.

### Request Example
{
  "title": "Test Regex",
  "status": "test",
  "logsource": {
    "category": "test_category",
    "product": "test_product"
  },
  "detection": {
    "sel": {
      "fieldA|re": "foo.*bar",
      "fieldB": "foo",
      "fieldC": "bar"
    },
    "condition": "sel"
  }
}

### Response
#### Success Response (200)
- **queries** (array) - Array of converted SPL queries with regex handling.

#### Response Example
{
  "queries": ["fieldB=\"foo\" fieldC=\"bar\"\n| regex fieldA=\"foo.*bar\""]
}
```

--------------------------------

### Complex Logical Operations and IN Expressions

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Demonstrates handling of complex logical operations including OR conditions and IN expressions with multiple values. Shows how the backend processes wildcard patterns and multiple field values. Essential for creating sophisticated detection rules with flexible matching criteria.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

backend = SplunkBackend()

# OR expression across multiple detection items
or_rule = SigmaCollection.from_yaml("""
title: Test OR
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel1:
        fieldA: valueA
    sel2:
        fieldB: valueB
    condition: 1 of sel*
""")

result = backend.convert(or_rule)
# Output: ['fieldA="valueA" OR fieldB="valueB"']

# IN expression with multiple values including wildcards
in_rule = SigmaCollection.from_yaml("""
title: Test IN
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA:
            - valueA
            - valueB
            - valueC*
    condition: sel
""")

result = backend.convert(in_rule)
# Output: ['fieldA IN ("valueA", "valueB", "valueC*")']
```

--------------------------------

### Convert Multiple Regex with Implicit OR to Splunk

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Demonstrates converting a Sigma rule with multiple regex patterns and implicit OR conditions into a Splunk query that utilizes `rex` and `eval` to extract and evaluate patterns.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

multi_regex_rule = SigmaCollection.from_yaml("""
title: Test Multiple Regex
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA|re:
            - foo.*bar
            - boo.*foo
        fieldB: foo
    condition: sel
""")

result = backend.convert(multi_regex_rule)
```

--------------------------------

### Apply Custom Field Mappings in Splunk - Python

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Demonstrates creating custom field mappings in PySigma to translate generic Sigma fields to Splunk-specific names via a processing pipeline. Depends on SplunkBackend, SigmaCollection, and ProcessingPipeline from sigma. Input is a YAML pipeline and Sigma rule; output is converted query with mapped fields. Limitations include requiring predefined mappings and potential performance overhead in large pipelines.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection
from sigma.processing.pipeline import ProcessingPipeline

# Define custom field mapping pipeline
pipeline = ProcessingPipeline.from_yaml("""
name: Custom Field Mapping
priority: 100
transformations:
    - id: field_mapping
      type: field_name_mapping
      mapping:
        username: User
        hostname: Computer
        process_name: Image
""")

backend = SplunkBackend(pipeline)

rule = SigmaCollection.from_yaml("""
title: Custom Mapping Example
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        username: admin
        hostname: DC01
    condition: sel
""")

result = backend.convert(rule)
# Output: ['User="admin" Computer="DC01"']
# username and hostname are mapped to User and Computer
```

--------------------------------

### Converting Rules with OR and IN Expressions

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

Handles complex logical operations including OR conditions and IN expressions with multiple values during Sigma rule conversion.

```APIDOC
## POST /splunk/convert/logical

### Description
Converts Sigma rules containing OR conditions and IN expressions with multiple values into SPL queries.

### Method
POST

### Endpoint
/splunk/convert/logical

### Parameters
#### Request Body
- **rule** (object) - Required - The Sigma rule with OR or IN expressions to be converted.

### Request Example (OR Expression)
{
  "title": "Test OR",
  "status": "test",
  "logsource": {
    "category": "test_category",
    "product": "test_product"
  },
  "detection": {
    "sel1": {
      "fieldA": "valueA"
    },
    "sel2": {
      "fieldB": "valueB"
    },
    "condition": "1 of sel*"
  }
}

### Request Example (IN Expression)
{
  "title": "Test IN",
  "status": "test",
  "logsource": {
    "category": "test_category",
    "product": "test_product"
  },
  "detection": {
    "sel": {
      "fieldA": ["valueA", "valueB", "valueC*"]
    },
    "condition": "sel"
  }
}

### Response
#### Success Response (200)
- **queries** (array) - Array of converted SPL queries.

#### Response Example (OR Expression)
{
  "queries": ["fieldA=\"valueA\" OR fieldB=\"valueB\""]
}

#### Response Example (IN Expression)
{
  "queries": ["fieldA IN (\"valueA\", \"valueB\", \"valueC*\")"]
}
```

--------------------------------

### Detect Field Existence in Splunk - Python

Source: https://context7.com/sigmahq/pysigma-backend-splunk/llms.txt

This code shows how to use the exists modifier in Sigma rules to check for field presence or absence in Splunk queries. It depends on SplunkBackend and SigmaCollection from the sigma library. Input is a YAML Sigma rule specifying exists: yes or no; output is SPL with presence checks like fieldA=* or absence via NOT. Limitations include reliance on Splunk's wildcard matching and no support for custom absence logic.

```python
from sigma.backends.splunk import SplunkBackend
from sigma.collection import SigmaCollection

backend = SplunkBackend()

exists_rule = SigmaCollection.from_yaml("""
title: Field Existence Check
status: test
logsource:
    category: test_category
    product: test_product
detection:
    sel:
        fieldA|exists: yes
        fieldB|exists: no
    condition: sel
""")

result = backend.convert(exists_rule)
# Output: ['fieldA=* NOT fieldB=*']
# fieldA=* checks for presence, NOT fieldB=* checks for absence
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.