What are SIEM correlation rules, and how do they help detect threats? Provide an example of a correlation rule you might create to detect a specific attack pattern.

Sample answer preview

SIEM correlation rules are logic-based definitions that analyze events from multiple sources to identify patterns indicative of security threats. Rather than alerting on individual events that might be innocuous in isolation, correlation rules connect related events to detect…