Glossary: Security Monitoring and Automation

correlation rule

Also written: correlation, correlates

A SIEM rule that links different events, within one source or across many. success.sql pairs each successful sign-in with 5 or more failures from the same address in the 10 minutes before it.