From 4bdbd3bd73965e7f144dcf98f3b71338706385eb Mon Sep 17 00:00:00 2001
From: Mat0vu <73690594+Mat0vu@users.noreply.github.com>
Date: Mon, 17 Feb 2025 08:50:35 +0100
Subject: [PATCH] add timespan to convert_correlation

---
 sigma/conversion/base.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sigma/conversion/base.py b/sigma/conversion/base.py
index 592ce30d..32c618c0 100644
--- a/sigma/conversion/base.py
+++ b/sigma/conversion/base.py
@@ -1837,6 +1837,7 @@ def convert_correlation_rule_from_template(
             template[method].format(
                 search=search,
                 typing=self.convert_correlation_typing(rule),
+                timespan=self.convert_timespan(rule.timespan, method),
                 aggregate=self.convert_correlation_aggregation_from_template(
                     rule, correlation_type, method, search
                 ),