Sigma tactics organizer

[dan21san]

Summary of the Pull Request

As discuss here #4624 this PR add in the tools folder a simple script to organize the Sigma rules into the Mitre ATT&CK framework.

Changelog

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[phantinuss]

I'd like to add the possibility to have multiple input folders for Sigma rules. The repo is structured so that we use multiple folders (rules, rules-emerging-threats, rules-threat-hunting). By default we shouldn't add all of these but the script should be able to handle multiple input directories.

Other than that it looks good to me so far. I would test it a bit locally first before merging, though. Haven't done that yet.

[dan21san]

@phantinuss yes your suggestion is very interesting :)
For now, I have only considered the "main" folder rule, but I think it is easily fixable.