**Problem**
`getCmp()` in `vql/sigma/evaluator/correlation.go` only handled `gte`,
`lte` and `eq`. Any other condition key (`gt`, `lt`, `neq`, or a typo
like `gtt`) fell through to an always-true comparator, so those rules
fired on the first matching event.
**Fix**
* `getCmp()` now supports all six Sigma correlation operators: `gt`,
`gte`, `lt`, `lte`, `eq`, `neq`.
* All operators in a condition must pass, so ranges still work (e.g.
`{gte: 5, lte: 10}`).
* The `field` key (used by `value_count`) is skipped as before.
* An unknown operator now returns an error (`unsupported correlation
condition "gtt"`), passed on by `NewEventCount()` and `NewValueCount()`
with the rule title.
**Behavior changes**
* Rules using `gt`, `lt` or `neq` now alert only when the condition
holds, so they alert less often, and correctly.
* Rules with an unknown operator no longer match everything. They log
the error and produce no hits.
---------
Co-authored-by: Claude Opus 5.5 <[email protected]>
