sigmalite

Parser collapses `field: null` and `field: ''` into the same atom, so null rules cannot match field absence

Marshaling Back to YAML

Sigma Correlated Detection Support?

Support Filter Rules