Detection Engineering
Sigma 2.1 Correlation Rules
Understand Sigma 2.1 correlation as stateful reasoning over related events, with explicit aliases, grouping, windows, order, cardinality, and backend limits.
Tag
Correlation
Correlation concepts and practices used in modern detection engineering.
4 resources
Resources in this tag
Browse all resources
Detection Engineering
Entity Resolution for Users, Hosts, Sessions, Workloads, and Resources
Relate users, sessions, devices, workloads, applications, and resources across changing identifiers without turning uncertain joins into false identity or causality.
Detection Engineering
Event Time, Ingest Time, Clock Drift, and Late Data
Distinguish event, observation, ingest, and processing time so windows and sequences reflect behavior without hiding clock drift, delayed delivery, or late evidence.
Detection Engineering
Choosing an Analytic: Match, Threshold, Sequence, Graph, Baseline, or Risk Score
Choose a match, threshold, sequence, graph, baseline, or risk model by the security claim you need to support—not by which feature a platform makes easiest to deploy.