"Generate: false" being ignored when chaining correlation rules.

sigma/conversion/base.py

@@ -767,8 +767,10 @@ def convert_correlation_rule(
         ]
         rule.set_conversion_result(finalized_queries)
         rule.set_conversion_states(states)
-
-        return finalized_queries
+        if rule._output:
+            return finalized_queries
+        else:
+            return []
 
     @abstractmethod
     def convert_correlation_event_count_rule(

tests/test_conversion_correlations.py

@@ -443,6 +443,66 @@ def test_correlation_generate_chained_rule(test_backend):
     ]
 
 
+def test_correlation_chained_rule_without_generate(test_backend):
+    rule_collection = SigmaCollection.from_yaml("""
+title: Successful login
+name: successful_login
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID:
+            - 528
+            - 4624
+    condition: selection
+---
+title: Single failed login
+name: failed_login
+logsource:
+    product: windows
+    service: security
+detection:
+    selection:
+        EventID:
+            - 529
+            - 4625
+    condition: selection
+---
+title: Multiple failed logons
+name: multiple_failed_login
+correlation:
+    type: event_count
+    rules:
+        - failed_login
+    generate: false
+    group-by:
+        - User
+    timespan: 10m
+    condition:
+        gte: 10
+---
+title: Multiple Failed Logins Followed by Successful Login
+status: test
+correlation:
+    type: temporal_ordered
+    rules:
+        - multiple_failed_login
+        - successful_login
+    generate: false
+    group-by:
+        - User
+    timespan: 10m
+            """)
+
+    assert test_backend.convert(rule_collection) == [
+        """subsearch { EventID in (529, 4625)\n| aggregate window=10min count() as event_count by User\n| where event_count >= 10 | set event_type="multiple_failed_login" }
+subsearch { EventID in (528, 4624) | set event_type="successful_login" }
+| temporal ordered=true window=10min eventtypes=multiple_failed_login,successful_login by User
+| where eventtype_count >= 2 and eventtype_order=multiple_failed_login,successful_login""",
+    ]
+
+
 def test_correlation_not_supported(monkeypatch, test_backend, event_count_correlation_rule):
     monkeypatch.setattr(test_backend, "correlation_methods", None)
     with pytest.raises(NotImplementedError, match="Backend does not support correlation"):