fix: OR/AND precedence inversion widens emitted queries in SPL and SPL2 backends

[cristianchiriac]

Summary

Fixes #73.

Both the classic SPL backend (splunk.py) and the SPL2 backend (spl2.py) declared their operator precedence as (ConditionNOT, ConditionOR, ConditionAND) — i.e. OR binds tighter than AND. But:

• splunk.py emits AND as juxtaposition (and_token = " "), which in SPL binds tighter than an explicit OR.
• spl2.py emits explicit AND/OR tokens, which follow standard boolean precedence (AND binds tighter than OR).

In both cases the declared precedence was inverted relative to the language actually being emitted, so compare_precedence concluded that an OR nested inside an AND does not need group_expression parentheses, and omitted them. The resulting query is broader than the rule: the AND-ed conjuncts apply only to the first disjunct, and every later disjunct matches unscoped.

from sigma.collection import SigmaCollection
from sigma.backends.splunk import SplunkBackend
from sigma.pipelines.splunk import splunk_windows_pipeline

RULE = """
title: OR group ANDed with a scope predicate
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\\net.exe'
        - OriginalFileName: 'net.exe'
    selection_cli:
        CommandLine|contains: ' localgroup'
    condition: selection_img and selection_cli
"""
print(SplunkBackend(splunk_windows_pipeline()).convert(SigmaCollection.from_yaml(RULE))[0])

Before: Image="*\\net.exe" OR OriginalFileName="net.exe" CommandLine="* localgroup*" — SPL parses this as (Image=...) OR (OriginalFileName=... AND CommandLine=...), so a bare Image match fires with no CommandLine requirement at all.

After: (Image="*\\net.exe" OR OriginalFileName="net.exe") CommandLine="* localgroup*" — matches the rule's condition. The SPL2 backend had the identical bug for the same underlying reason and is fixed the same way.

Fix

Reorder the precedence tuple to (ConditionNOT, ConditionAND, ConditionOR) in both splunk.py and spl2.py, matching the actual precedence of the language each backend emits.

A few existing tests encoded the same bug in their expected output (an ungrouped OR nested in an AND, e.g. the CIDR-expansion and data-model tests) — those are updated to the correct, parenthesized form. A couple of others (the multi-valued-field IN(...) cases, and an AND nested in OR that no longer needs its parens) gain or lose harmless-but-no-longer-necessary grouping; updated their expected output too.

Test plan

• Added test_splunk_or_nested_in_and_expression, reproducing the issue's example directly against the SPL backend.
• pytest — full suite passes (128 passed).