feat: Add macOS ESF pipeline (ecs_macos_esf)

Add processing pipeline for macOS Endpoint Security Framework (ESF) events.

- Maps Sigma taxonomy fields to ECS fields
- Supports 16 logsource categories (process_creation, file_event, etc.)
- Includes 8 unit tests
- Adds field mappings for process, user, file, network, and code signature fields
- Includes macOS-specific fields (SignalNumber, PtraceRequest, XpcServiceName, etc.)

Author: eric-nebulock

README.md

@@ -21,7 +21,8 @@ Further, it contains the following processing pipelines in `sigma.pipelines.elas
 * ecs_zeek_beats in zeek submodule: Zeek ECS mapping from Elastic.
 * ecs_zeek_corelight in zeek submodule: Zeek ECS mapping from Corelight.
 * zeek_raw in zeek submodule: Zeek raw JSON log field naming.
-* ecs_kubernetes in kubernetes submodule: ECS mapping for Kubernetes audit logs ingested with Kubernetes integration
+* ecs_kubernetes in kubernetes submodule: ECS mapping for Kubernetes audit logs ingested with Kubernetes integration.
+* ecs_macos_esf in macos submodule: ECS mapping for macOS Endpoint Security Framework (ESF) events.
 
 This backend is currently maintained by:
 

sigma/pipelines/elasticsearch/__init__.py

@@ -1,12 +1,14 @@
 from .windows import ecs_windows, ecs_windows_old
 from .zeek import ecs_zeek_beats, ecs_zeek_corelight, zeek_raw
 from .kubernetes import ecs_kubernetes
+from .macos import ecs_macos_esf
 
 pipelines = {
     "ecs_windows": ecs_windows,
     "ecs_windows_old": ecs_windows_old,
     "ecs_zeek_beats": ecs_zeek_beats,
     "ecs_zeek_corelight": ecs_zeek_corelight,
     "zeek": zeek_raw,
-    "ecs_kubernetes": ecs_kubernetes, 
+    "ecs_kubernetes": ecs_kubernetes,
+    "ecs_macos_esf": ecs_macos_esf,
 }