Hi! Thanks for the pull request! I've identified an issue while code review: It's possible that this change misses to output converted queries because there can be more queries returned by the backend than input rules, see the corresponding comment for details.

Another issue I've discovered was while I tried to change to pyTest's tmp_path way to manage temporary outputs while testing. This has various advantages like output retention, automatic handling etc. Using tmp_path causes that an absolute path is provided and this caused the code to fail in creation of the output directory. It appears that ensure_dir_exists() has issues with drive letters in paths, which I recommend to replace anyways with pathlib.Path.mkdir() that basically does the same.

Hi Thomas,
thanks for the feedback and the tips, I´m not so familiar with pytest and didn´t know about the tmp_path possibility, but that´s a nice solution. I´ve changed the path handling now to use this and fixed also the ensure_dir_exists().

I can´t see any comments of you in the code review part at the moment but I also realized the issue now. I added a new test test_convert_correlation_rule_to_output_dir with a correlation rule and the generate: true attribute in the rule so that for one rule, two results are returned by the convert function. Currently the code would only write the first part of the result into the file.

While for only a single translated rule this can be handled easily, I´m wondering how this is solved best in general, because if a complete directory of rules is traversed and some of them generate more than one output, how can these outputs be mapped to the corresponding paths of the input rules?