Support Temporal Proximity correlation

[YamatoSecurity]

Support Temporal Proximity correlation

https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#temporal-proximity-temporal

Reference: https://blog.sigmahq.io/introducing-sigma-correlations-52fe377f2527

Sample rule from blog:

title: CVE-2023-22518 Exploit Chain
description: Access to endpoint vulnerable to CVE-2023-22518 with suspicious process creation.
status: experimental
correlation:
    type: temporal
    rules:
        - a902d249-9b9c-4dc4-8fd0-fbe528ef965c
        - 1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db
    group-by:
        - Computer
    timespan: 10s
level: high

(Note: when testing you can use any two rules that find two different events within a short period of time.)

I think this is similar to the count rules we already have but instead of treating multiple rules as OR, we treat them as AND. And then we ignore the part about aggregating fields, so should actually be easier to implement. 😄 (Well, except for filtering to check if they have certain same fields, defined by group-by)

@fukusuket I think this one will be very easy for you, so I will assign you. 😉

[fukusuket]

@YamatoSecurity
Thank you for the assignment! Yes, I would love to implement it!!💪