FR: Add correlation rules to the Sigma engine

[scudette]

A full description of correlations is found here https://open.substack.com/pub/ecapuano/p/atomic-and-stateful-detection-rules

[mgreen27]

https://sigmahq.io/docs/meta/correlations.html

Reading the sigma spec - there doesnt look like too many options for stateful process detections that we can do in vql wrt heirarchy

[joeavanzato]

Just a +1 on this feature - I think this would be a great addition to help support writing scalable logic in Sigma format and applying it to arbitrary artifacts.