Fix AddConditionTransformation to handle empty conditions

[Copilot]

When all query terms are deferred (e.g., Splunk regex expressions), the condition string becomes empty. AddConditionTransformation was creating invalid conditions like "additional and ()" instead of "additional".

Changes

• sigma/processing/transformations/condition.py: Modified apply_condition() to check if condition is empty before wrapping in parentheses
• tests/test_processing_transformations.py: Added tests for empty condition scenarios with and without negation

Example

# Before: empty condition → "additional and ()"
# After: empty condition → "additional"

rule.detection.parsed_condition[0].condition = ""  # e.g., all items deferred
transformation = AddConditionTransformation({"EventID": 1}, "additional")
transformation.apply(rule)
# Result: "additional" (not "additional and ()")

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Add Condition Transformation not applied if condition is empty</issue_title>
<issue_description>This is required if all query terms are moved into deferred query parts, eg Splunk regular expressions. </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Add Condition Transformation not applied if condition is empty #364

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.