Fixed chaining of correlation rules

SigmaHQ · Oct 24, 2024 · 935f976 · 935f976
1 parent 4dbedb2
commit 935f976
Showing 1 changed file with 5 additions and 7 deletions.
diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py
@@ -581,7 +581,7 @@ def convert_correlation_rule(
         ]
 
         # Apply the finalization step
-        finalized_query = [
+        finalized_queries = [
             self.finalize_query(
                 rule,
                 query,
@@ -591,8 +591,10 @@ def convert_correlation_rule(
             )
             for index, query in enumerate(queries)
         ]
+        rule.set_conversion_result(finalized_queries)
+        rule.set_conversion_states(states)
 
-        return finalized_query
+        return finalized_queries
 
     @abstractmethod
     def convert_correlation_event_count_rule(
@@ -1720,11 +1722,7 @@ def convert_correlation_search(
                             ),
                         )
                         for rule_reference in rule.rules
-                        for query in (
-                            rule_reference.rule.get_conversion_result()
-                            if not isinstance(rule_reference.rule, SigmaCorrelationRule)
-                            else self.convert_correlation_rule(rule_reference.rule)
-                        )
+                        for query in rule_reference.rule.get_conversion_result()
                     )
                 ),
                 **kwargs,