diff --git a/salt/soc/final_sigma_pipeline.yaml b/salt/soc/final_sigma_pipeline.yaml
new file mode 100644
index 000000000..656bfbb3e
--- /dev/null
+++ b/salt/soc/final_sigma_pipeline.yaml
@@ -0,0 +1,7 @@
+name: Security Onion - Final Pipeline
+priority: 95
+transformations:
+    - id: override_field_name_mapping
+      type: field_name_mapping
+      mapping:
+        FieldNameToOverride: NewFieldName
diff --git a/salt/soc/so_sigma_pipeline.yaml b/salt/soc/so_sigma_pipeline.yaml
new file mode 100644
index 000000000..a1c4d6d62
--- /dev/null
+++ b/salt/soc/so_sigma_pipeline.yaml
@@ -0,0 +1,18 @@
+name: Security Onion Baseline Pipeline
+priority: 90
+transformations:
+    - id: baseline_field_name_mapping
+      type: field_name_mapping
+      mapping:
+        cs-method: http.method
+        c-uri: http.uri
+        c-useragent: http.useragent
+        cs-version: http.version
+        uid: user.uid
+        sid: rule.uuid
+        answer: answers
+        query: dns.query.name
+        src_ip: destination.ip.keyword
+        src_port: source.port
+        dst_ip: destination.ip.keyword
+        dst_port: destination.port
\ No newline at end of file
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index 0dd39620b..fe672fe3e 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -32,6 +32,14 @@ soc:
         global: True
         advanced: True
         helpLink: soc-customization.html
+      final_sigma_pipeline__yaml:
+        title: Final Sigma Pipeline
+        description: Final Processing Pipeline for Sigma Rules
+        syntax: yaml
+        file: True
+        global: True
+        advanced: True
+        helpLink: soc-customization.html
   config:
     licenseKey:
       title: License Key
@@ -62,6 +70,11 @@ soc:
         global: True
         advanced: True
       modules:
+        elastalertengine:
+          sigmaRulePackages:
+            description: 'One of the following: core | core+ | core++ | all'
+            global: True
+            advanced: False
         elastic:
           index:
             description: Comma-separated list of indices or index patterns (wildcard "*" supported) that SOC will search for records.