Deal with empty string for ignore_case_brackets

[frack113]

An empty string must convert to a complex regex .

title: test
id: c6c14f6d-e430-4737-bca7-b0fe5496dc07
status: test
date: 2024-11-08
logsource:
    product: windows
    category: pipe_created
detection:
    selection_1:
        Image: null
    selection_2:
        Image: ''
    condition: 1 of selection_*
level: medium

name: CaseSensitive
priority: 20
transformations:
  - id: field_case
    type: regex
    method: ignore_case_brackets
    field_name_conditions:
      - type: include_fields
        fields: 
          - Image

Before

sigma convert -t lucene rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
(NOT _exists_:Image) OR Image://
sigma convert -t splunk rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
Error: Error while conversion: ORing regular expressions is not yet supported by Splunk backend in rule.yml

After

sigma convert -t lucene rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
(NOT _exists_:Image) OR Image:""

sigma convert -t splunk rule.yml -p casesensitive.yml
Parsing Sigma rules  [####################################]  100%
Image!=* OR Image=""