SIGMA & OPtimiz rules check

[lprat]

TODO:

• Add SIGMA rules
  • Change code for use "OR": create all case and sort
  • Optimiz rule check: keep result of each test for all rules on one event