Provider and event ID asscoiation lost in complext quries.

[JPvRiel]

When testing highly complex custom queries, I noticed event IDs and Providers would get mismatched.

E.g., given this highly complex select query xpath where event ID 7045 belongs to the Service Control Manager provider:

    <Select Path='System'>
      *[
        System[
          <!-- 5 query groups (limit 22) -->
          <!-- Event log service events, e.g. event ID 104 -->
          Provider[@Name='Microsoft-Windows-Eventlog'] or
          <!-- 7034: Service terminated unexpectidly, 7045: Service install -->
          (
            Provider[@Name='Service Control Manager'] and
            (
              EventID=7034 or
              EventID=7045
            )
          ) or
          <!-- Anti-malware *old* events, but only detect events (cuts down noise) -->
          (
            Provider[@Name='Microsoft Antimalware'] and
            (
              EventID&gt;=1116 and
              EventID&lt;=1119
            )
          ) or
          <!-- 12: System startup (includes OS/SP/Version), 13: shutdown -->
          (
            Provider[@Name='Microsoft-Windows-Kernel-General'] and
            (
              EventID=12 or
              EventID=13
            )
          ) or
          <!-- Shutdown initiate requests, with user, process and reason (if supplied) -->
          (
            Provider[@Name='USER32'] and
            EventID=1074
          )
        ]
      ]
    </Select>

the query parsing output to yaml did list all event IDs, and all providers, but lost the relationship:

    - EventIDs:
      - 7034
      - 7045
      - 12
      - 13
      - 1074
      - 1116
      - 1117
      - 1118
      - 1119
      Path: System
      Providers:
      - Microsoft-Windows-Eventlog
      - Service Control Manager
      - Microsoft Antimalware
      - Microsoft-Windows-Kernel-General
      - USER32
      XPath: "\n      *[\n        System[\n          \n          \n          Provider[@Name='Microsoft-Windows-Eventlog']\
        \ or\n          \n          (\n            Provider[@Name='Service Control\
        \ Manager'] and\n            (\n              EventID=7034 or\n          \
        \    EventID=7045\n            )\n          ) or\n          \n          (\n\
        \            Provider[@Name='Microsoft Antimalware'] and\n            (\n\
        \              EventID>=1116 and\n              EventID<=1119\n          \
        \  )\n          ) or\n          \n          (\n            Provider[@Name='Microsoft-Windows-Kernel-General']\
        \ and\n            (\n              EventID=12 or\n              EventID=13\n\
        \            )\n          ) or\n          \n          (\n            Provider[@Name='USER32']\
        \ and\n            EventID=1074\n          )\n        ]\n      ]\n    "

And the csv output to query_combinations_flattened_by_event.csv confused the association to USER32 instead of Service Control Manager and shows False for Reference.custom on the row with "Service Control Manager":

Id,Metadata.Keywords,Metadata.Description,Metadata.Level,Metadata.Level.Value,Metadata.Task,Metadata.Opcode,Paths.Name,Paths.Providers.Name,Reference.microsoft,Reference.microsoft.FileList,Reference.microsoft.QueryIDList,Reference.microsoft.SelectCount,Reference.microsoft.SuppressCount,Reference.nsacyber,Reference.nsacyber.FileList,Reference.nsacyber.QueryIDList,Reference.nsacyber.SelectCount,Reference.nsacyber.SuppressCount,Reference.palantir,Reference.palantir.FileList,Reference.palantir.QueryIDList,Reference.palantir.SelectCount,Reference.palantir.SuppressCount,Reference.custom,Reference.custom.FileList,Reference.custom.QueryIDList,Reference.custom.SelectCount,Reference.custom.SuppressCount
7045,,,,,,,System,Microsoft Antimalware,False,,,0,0,False,,,0,0,False,,,0,0,True,./custom/Security-Baseline-1.xml,0,1,0
7045,Classic,,,,,,System,Service Control Manager,True,./microsoft/Appendix E - Annotated baseline subscription event query.xml,5,1,0,True,./nsacyber/Event-Forwarding-Guidance/Subscriptions/NT6/ServiceManager.xml,0,1,0,True,./palantir/windows-event-forwarding/wef-subscriptions/Services.xml,0,1,0,False,,,0,0
7045,,,,,,,System,USER32,False,,,0,0,False,,,0,0,False,,,0,0,True,./custom/Security-Baseline-1.xml,0,1,0

It is likely necessary to refactor the data parsing and representation to link the provider with event IDs instead of just listing them for each select or suppress.