Module parser 

Main YAML → AST parser for Sigma rules, correlations, filters, and collections.

Handles:

• Single-document YAML (one rule)
• Multi-document YAML (— separator, action: global/reset/repeat)
• Detection section parsing (named detections, field modifiers, values)
• Correlation rule parsing
• Filter rule parsing
• Directory-based rule collection loading

Reference: pySigma collection.py, rule.py, rule/detection.py, correlations.py

Functions

parse_field_spec

Parse a field specification string like "TargetObject|endswith".

parse_sigma_directory

Parse all Sigma YAML files from a directory (recursively).

parse_sigma_file

Parse a single Sigma YAML file from a path.

parse_sigma_yaml

Parse a YAML string containing one or more Sigma documents.