Issue with attribute field in sigma-correlation-rules-schema.json for correlation rules value_count

[danw274]

I'm using the specification sigma-correlation-rules-schema.json to write correlation rules of type "value_count" in Visual Studio Code. According to the documentation, the attribute "field" must be specified within the "condition" section. However, in the current version of the sigma-correlation-rules-schema.json, the attribute "field" is required outside of the condition section.

Here is an example.

This is how it should look according to the documentation:

title: Failed login
id: 0e95725d-7320-415d-80f7-004da920fc12
correlation:
    type: value_count
    rules:
        - 5638f7c0-ac70-491d-8465-2a65075e0d86
    group-by:
        - ComputerName
        - WorkstationName
    timespan: 1d
    condition:
        field: User
        gte: 100

However, the sigma-correlation-rules-schema.json requires the field attribute outside of condition, which is inconsistent with the documentation:

title: Failed login
id: 0e95725d-7320-415d-80f7-004da920fc12
correlation:
    type: value_count
    rules:
        - 5638f7c0-ac70-491d-8465-2a65075e0d86
    group-by:
        - ComputerName
        - WorkstationName
    field: User # required because of sigma-correlation-rules-schema.json
    timespan: 1d
    condition:
        field: User
        gte: 100

In my opinion, the schema validation should be updated to reflect that the field attribute belongs inside the condition section when the type is value_count. This is currently being examined:

210        "if": { "properties": {"type": {"const": "value_count"}}},
211        "then": {"required": ["condition", "field", "group-by", "timespan"]}