<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-siem-rule-deployment
description: >-
  Automate SIEM detection rule deployment for Splunk, Elastic Security, and
  Microsoft Sentinel. Build pipelines that convert Sigma rules, validate syntax,
  deploy to SIEM APIs, track rule coverage against ATT&CK, and manage rule
  lifecycle including testing, tuning, and deprecation.
domain: cybersecurity
subdomain: automation-scripting
tags:
  - siem
  - sigma
  - splunk
  - elastic
  - sentinel
  - detection-engineering
  - mitre-attack
  - rule-deployment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Automating SIEM Rule Deployment

## Overview

Detection rule deployment at scale requires automation — converting Sigma rules
to SIEM-native formats, validating syntax, pushing to SIEM APIs, tracking ATT&CK
coverage, and managing rule lifecycle. This skill covers building Python pipelines
that automate the full detection engineering workflow from Sigma source to
production SIEM deployment.

Mode: `[MODE: BLUE]` — Detection engineering and SIEM management.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `pyyaml` (`pip install requests pyyaml`) | Required |
| Sigma CLI (`pip install sigma-cli`) for rule conversion | Required |
| SIEM API access | Splunk REST API, Elastic Security API, or Sentinel API |
| Sigma rules repository (local clone of SigmaHQ/sigma) | Required |

## Key Concepts

### Sigma Rule Conversion

```bash
# Convert to Splunk
sigma convert -t splunk -p splunk_cim rule.yml

# Convert to Elastic
sigma convert -t elasticsearch -p ecs_windows rule.yml

# Convert to Microsoft Sentinel KQL
sigma convert -t microsoft365defender rule.yml

# Batch conversion
for f in rules/*.yml; do
  sigma convert -t splunk -p splunk_cim "$f" > "converted/$(basename ${f%.yml}.spl)"
done
```

### Splunk API Deployment

```python
import requests

def deploy_splunk_saved_search(
    base_url: str, token: str, name: str, search: str, severity: str = "high"
) -> dict:
    """Deploy a saved search (detection rule) to Splunk."""
    url = f"{base_url}/servicesNS/admin/search/saved/searches"
    headers = {"Authorization": f"Bearer {token}"}
    data = {
        "name": name,
        "search": search,
        "is_scheduled": "1",
        "cron_schedule": "*/5 * * * *",
        "alert_type": "number of events",
        "alert_comparator": "greater than",
        "alert_threshold": "0",
        "alert.severity": {"critical": "6", "high": "5", "medium": "3", "low": "2"}.get(severity, "3"),
    }
    resp = requests.post(url, headers=headers, data=data, verify=False, timeout=30)
    return {"name": name, "status": resp.status_code, "success": resp.status_code in (200, 201)}
```

### ATT&CK Coverage Tracking

```python
def calculate_attack_coverage(rules: list[dict]) -> dict:
    """Calculate ATT&CK technique coverage from deployed rules."""
    techniques = set()
    tactics = set()
    for rule in rules:
        for tag in rule.get("tags", []):
            if tag.startswith("attack.t"):
                techniques.add(tag.replace("attack.", "").upper())
            elif tag.startswith("attack."):
                tactics.add(tag.replace("attack.", ""))
    return {
        "techniques_covered": sorted(techniques),
        "tactics_covered": sorted(tactics),
        "technique_count": len(techniques),
        "tactic_count": len(tactics),
    }
```

## Workflow

### Step 1: Convert Sigma Rules

```bash
node scripts/agent.js --action convert --rules-dir ./sigma-rules/ --target splunk --output /tmp/converted/
```

### Step 2: Validate Converted Rules

```bash
node scripts/agent.js --action validate --rules-dir /tmp/converted/
```

### Step 3: Deploy to SIEM

```bash
node scripts/agent.js --action deploy --rules-dir /tmp/converted/ --siem splunk --siem-url https://splunk:8089
```

### Step 4: Check ATT&CK Coverage

```bash
node scripts/agent.js --action coverage --rules-dir ./sigma-rules/
```

## Verification

- [ ] Sigma rules convert without errors to target SIEM format
- [ ] Deployed rules trigger on test data
- [ ] ATT&CK coverage report identifies gaps
- [ ] Rule lifecycle tracking shows deployment status
- [ ] Failed deployments produce actionable error messages

## References

- [Sigma Specification](https://github.com/SigmaHQ/sigma-specification)
- [Sigma Rules Repository](https://github.com/SigmaHQ/sigma)
- [Splunk REST API](https://docs.splunk.com/Documentation/Splunk/latest/RESTREF)
- [Elastic Detection Rules](https://www.elastic.co/guide/en/security/current/rules-api-overview.html)
- [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
