Add Sigma correlation rule support to the LogScale backend

[nephalemsec]

This adds Sigma correlation rule support to the LogScale backend. Correlation rules currently raise an error because the backend does not declare any correlation methods; with this change they convert to CrowdStrike Query Language.

Supported types

• event_count, value_count
• value_sum, value_avg, value_percentile, value_median
• temporal, including boolean/extended conditions such as rule_a and rule_b and not rule_c

Approach

The conversion follows the same search / aggregate / condition phase model as the Splunk backend, expressed with native CQL:

• bucket(span=..., field=[...], function=...) for the time-windowed aggregation, with limit=max so group-by results are not capped at the default of 10 series
• case { ... | event_type := "<rule>" } to tag events by their originating rule for temporal correlations, then count(field=event_type, distinct=true) to count how many referenced rules fired per group
• test(...) for the threshold filter
• for boolean temporal conditions, collect() the fired rules per group and test membership with array:contains()

Field aliases are normalised with | <alias> := <field> so group-by works across rules that use different field names. The referenced rules are used as subqueries and are not emitted separately, matching the existing backend behaviour.

temporal_ordered is not implemented: LogScale has no ordered-sequence primitive that fits the template model, so it raises NotImplementedError with a clear message rather than emitting an incorrect query.

Example

An event_count rule:

title: Failed logon attempts
name: failed_logon
status: test
logsource:
    category: test
detection:
    selection:
        EventType: failed_logon
    condition: selection
---
title: Multiple failed logons for a single user
status: test
correlation:
    type: event_count
    rules:
        - failed_logon
    group-by:
        - UserName
    timespan: 10m
    condition:
        gte: 10

converts to:

EventType=/^failed_logon$/i
| bucket(span=10m, limit=max, field=[UserName], function=count(as=event_count))
| test(event_count >= 10)

Testing

Adds tests/test_backend_logscale_correlation.py covering each correlation type, all condition operators, field aliases, timespan units, deferred sub-rules, boolean condition grouping and the unsupported paths. The full test suite passes and the backend module is at 100% coverage.

See the Sigma correlation rules specification for the rule format.