feat: add Sigma v2 Correlation feature

[fukusuket]

Hello, thank you so much for creating such an excellent crate.
We are using sigma-rust to power Sigma detection logic in our project, Suzaku.

Now, We are implementing correlation support as it is required in our project.
I believe we first need to discuss whether correlation functionality should be within the scope of this crate ... :)

@jopohl
To help facilitate the discussion and gather your feedback, I’ve created a prototype branch. I would very much appreciate your thoughts and feedback on this.

Thank you for your time.

[fukusuket]

The usage in a simple case and the test code can be found below. This feature is largely based on an implementation generated by the Coding Agent Claude, with adjustments and additional test cases I added.

• https://github.com/Yamato-Security/sigma-rust/blob/add-correlation-feature/examples/detect_correlation.rs
• https://github.com/Yamato-Security/sigma-rust/blob/add-correlation-feature/tests/correlation.rs

If this feature is considered a candidate for merging, I would like to adhere to coding guidelines as much as possible. Your honest feedback would be very helpful and much appreciated.

[fukusuket]

If starting with a discussion would be more appropriate than submitting a pull request at this stage, I’d be more than happy to close this PR and open a discussion instead — just say the word!

[Copilot]

Pull Request Overview

This PR introduces a prototype for Sigma v2 correlation by adding a new correlation module, updating core types with cloning capabilities, and providing an example for detecting correlated events.

• Expose and re-export correlation-handling APIs in the public crate surface
• Enable cloning on Event and EventValue so events can be timestamped and passed through the engine
• Add an end-to-end example (detect_correlation.rs) and necessary dependencies for chrono-based timestamp parsing

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

File	Description
src/lib.rs	Adds correlation module, re-exports, and a YAML parser wrapper
src/event.rs	Derives Clone on EventValue and Event
examples/detect_correlation.rs	New example demonstrating correlation setup and usage
Cargo.toml	Adds chrono and anyhow dependencies

Comments suppressed due to low confidence (5)

src/lib.rs:27

• [nitpick] The function name correlation_rule_from_yaml suggests a single rule but it returns multiple base and correlation rules. Consider renaming to correlation_rules_from_yaml or parse_correlation_rules_from_yaml for clarity.

pub fn correlation_rule_from_yaml(yaml: &str) -> ParseRulesResult {

src/lib.rs:15

• [nitpick] You re-export parse_rules_from_yaml and also provide a correlation_rule_from_yaml wrapper. To avoid confusion, consider consolidating to a single public parsing API or clearly documenting their differences.

pub use correlation::{

examples/detect_correlation.rs:3

• [nitpick] The example calls parse_rules_from_yaml directly but you’ve added a correlation_rule_from_yaml helper. For consistency, update the example to use the new wrapper or remove the wrapper if it’s redundant.

use sigma_rust::{

src/correlation.rs:1

• The new correlation functionality isn’t covered by any unit or integration tests. Adding tests for parsing, matching, and timespan logic would help catch regressions.

pub mod correlation {

Cargo.toml:24

• [nitpick] The anyhow dependency was added but isn’t used in the crate or the example. Consider removing it or updating error handling to leverage anyhow for more ergonomic error contexts.

anyhow = "1.0.98"

[fukusuket]

We have integrated this correlation feature into Suzaku and confirmed that it works as expected, as described below :)

• feat: add support correlation feature Yamato-Security/suzaku#97