feat: add support for correlation name lookup

[fukusuket]

What Changed

• added support for correlation rule's name lookup
• ref: https://blog.sigmahq.io/introducing-sigma-correlations-52fe377f2527

I would appreciate it if you could check it out when you have time🙏

[fukusuket]

Test

I confirmed following rule works.

title: Value Count TEST
id: 0e95725d-7320-415d-80f7-004da920fc11
level: informational
correlation:
  type: value_count
  rules:
    - rule-a
    - rule-b
  group-by:
    - Computer
  timespan: 5m
  condition:
    gte: 2
    field: SubStatus
---
title: Logon Failure (User Does Not Exist)
name: rule-a

logsource:
  product: windows
  service: security
detection:
  selection_basic:
    Channel: Security
    EventID: 4625
  selection_user_not_exist:
    SubStatus: "0xc0000064" #Username does not exist error
  condition: selection_basic and selection_user_not_exist
---
title: Logon Failure (Wrong Password)
name: rule-b

logsource:
  product: windows
  service: security
detection:
  selection_basic:
    Channel: Security
    EventID: 4625
  selection_wrong_password:
    SubStatus: "0xc000006a" #Wrong password
  condition: selection_basic and selection_wrong_password

% ./hayabusa csv-timeline -d ../hayabusa-sample-evtx -w -r test/test-value-count.yml

% cat timeline.csv | grep Value
"2016-09-20 01:50:06.477 +09:00","Value Count TEST","info","-","-","-","-","Count:2 ¦ SubStatus:0xc000006a/0xc0000064 ¦ Computer:DESKTOP-M5SN04R","-"
"2021-05-20 21:49:53.378 +09:00","Value Count TEST","info","-","-","-","-","Count:2 ¦ SubStatus:0xc000006a/0xc0000064 ¦ Computer:fs01.offsec.lan","-"

[fukusuket]

@YamatoSecurity @hitenkoku
When using correlation, it seems better not to output the detection results of the rules's field.(in the above example, It is better not to output the result of rule-a/rule-b?) 🤔

I would like to think about the specifications a little more, so I would like to create a separate issue to deal with this.

[YamatoSecurity]

@fukusuket LGTM! Thank you!