Sigma correlations support: Value Count

[YamatoSecurity]

@fukusuket This one is similar to Event Count by also looks for when fields are different so you probably should do this issue after Event Count.

Value Count sample:

title: Many failed logons to different users
id: 0e95725d-7320-415d-80f7-004da920fc12
correlation:
  type: value_count
  rules:
    - 8afa97ce-a217-4f7c-aced-3e320a57756d # Logon Failure (User Does Not Exist)
  group-by:
    - Computer
  timespan: 1h
  condition:
    field: TargetUserName
    gte: 10

This rule would alert if there are 10 or more different target user names within 1 hour for the same Computer

It would be similar to condition: selection | count(TargetUserName) by Computer >= 10

Here is an example of multiple group-bys

title: Many failed logons to different users
id: 0e95725d-7320-415d-80f7-004da920fc12
correlation:
  type: value_count
  rules:
    - 8afa97ce-a217-4f7c-aced-3e320a57756d # Logon Failure (User Does Not Exist)
  group-by:
    - Computer
    - IpAddress
  timespan: 1h
  condition:
    field: TargetUserName
    gte: 10

It would be similar to condition: selection | count(TargetUserName) by Computer,IpAddress >= 10 , however, it is not possible to specify multiple fields in by with count.

This rule would alert if there are 10 or more target user names with the same Computer and IpAddress fields.

[fukusuket]

I would love to implement this issue as well💪