TODO: - Add SIGMA rules - Change code for use "OR": create all case and sort - Optimiz rule check: keep result of each test for all rules on one event
