https://github.com/SigmaHQ/sigma-specification/blob/main/specification/sigma-correlation-rules-specification.md#field-name-aliases Need to write a test rule first. (@YamatoSecurity )
