diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py index 2df18ed1..423f4cc0 100644 --- a/sigma/conversion/base.py +++ b/sigma/conversion/base.py @@ -767,8 +767,10 @@ def convert_correlation_rule( ] rule.set_conversion_result(finalized_queries) rule.set_conversion_states(states) - - return finalized_queries + if rule._output: + return finalized_queries + else: + return [] @abstractmethod def convert_correlation_event_count_rule( diff --git a/tests/test_conversion_correlations.py b/tests/test_conversion_correlations.py index 43bdb7f3..532c606e 100644 --- a/tests/test_conversion_correlations.py +++ b/tests/test_conversion_correlations.py @@ -443,6 +443,66 @@ def test_correlation_generate_chained_rule(test_backend): ] +def test_correlation_chained_rule_without_generate(test_backend): + rule_collection = SigmaCollection.from_yaml(""" +title: Successful login +name: successful_login +logsource: + product: windows + service: security +detection: + selection: + EventID: + - 528 + - 4624 + condition: selection +--- +title: Single failed login +name: failed_login +logsource: + product: windows + service: security +detection: + selection: + EventID: + - 529 + - 4625 + condition: selection +--- +title: Multiple failed logons +name: multiple_failed_login +correlation: + type: event_count + rules: + - failed_login + generate: false + group-by: + - User + timespan: 10m + condition: + gte: 10 +--- +title: Multiple Failed Logins Followed by Successful Login +status: test +correlation: + type: temporal_ordered + rules: + - multiple_failed_login + - successful_login + generate: false + group-by: + - User + timespan: 10m + """) + + assert test_backend.convert(rule_collection) == [ + """subsearch { EventID in (529, 4625)\n| aggregate window=10min count() as event_count by User\n| where event_count >= 10 | set event_type="multiple_failed_login" } +subsearch { EventID in (528, 4624) | set event_type="successful_login" } +| temporal ordered=true window=10min eventtypes=multiple_failed_login,successful_login by User +| where eventtype_count >= 2 and eventtype_order=multiple_failed_login,successful_login""", + ] + + def test_correlation_not_supported(monkeypatch, test_backend, event_count_correlation_rule): monkeypatch.setattr(test_backend, "correlation_methods", None) with pytest.raises(NotImplementedError, match="Backend does not support correlation"):