Add Correlation Support

[nasbench]

This PR adds the necessary updates for the introduction of correlation rules to the SigmaHQ repo

[Copilot]

Pull Request Overview

This PR adds comprehensive support for correlation rules to the SigmaHQ validator framework. The changes enable validation of correlation rule files with specific naming conventions and metadata requirements, ensuring consistency with the existing detection rule validation patterns.

Key changes:

• Introduced new validators for correlation-specific requirements (minimum rules, group-by field existence)
• Added filename prefix validation requiring correlation files to start with correlation_
• Extended existing detection-only validators to properly handle correlation rules by checking instance types

Reviewed Changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/test_filename.py	Adds tests for correlation filename prefix validation including pure and combined file formats
tests/test_correlation.py	Comprehensive test suite for correlation validators covering rules minimum, group-by existence, and metadata requirements
tests/files/rules-correlations/invalid_prefix_name.yml	Test fixture for invalid correlation filename validation
tests/files/rules-correlations/correlation_valid_filename.yml	Test fixture for valid correlation filename validation
tests/files/rules-correlations/correlation_combined_format.yml	Test fixture for combined format files containing both detection and correlation rules
sigma/validators/sigmahq/metadata.py	Adds 'correlation' field to allowed custom attributes for correlation rules
sigma/validators/sigmahq/logsource.py	Updates validators to accept SigmaRuleBase and skip correlation rules for detection-specific checks
sigma/validators/sigmahq/filename.py	Implements correlation filename prefix validator and combined file detection logic
sigma/validators/sigmahq/field.py	Updates field validators to skip correlation rules that don't have detection-specific fields
sigma/validators/sigmahq/detection.py	Updates validators to accept SigmaRuleBase and adds correlation rule type checking
sigma/validators/sigmahq/correlation.py	New module implementing correlation-specific validators for rules minimum and group-by requirements
pyproject.toml	Version bump from 0.12.2 to 0.13.0 reflecting new correlation support feature

Comments suppressed due to low confidence (1)

sigma/validators/sigmahq/filename.py:93

• Except block directly handles BaseException.

        except:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.