Question

A SOC analyst is building a SIEM correlation rule to detect credential-stuffing attacks against a public-facing authentication API. The current rule fires an alert whenever ANY of the following occur: more than 50 failed logins from a single IP in 5 minutes, OR failed logins across more than 20 distinct usernames from one IP, OR a login from a geolocation the account has never used. During the first week, the rule generated over 4,000 alerts, of which fewer than 20 were confirmed malicious, overwhelming the team. Management wants higher-fidelity detection without deploying new tooling. Which change to the correlation logic will BEST improve alert fidelity for this specific attack pattern?

Accepted Answer

Combine the failed-login-volume and distinct-username conditions with AND logic, requiring both a high failure count and spraying across many accounts from the same source before alerting

Answer

Lower each individual threshold (e.g., 25 failed logins, 10 usernames, any new geolocation) so more suspicious activity is captured earlier

Answer

Remove the correlation rule and forward all authentication logs to a data lake for periodic manual review instead

Answer

Add a fourth OR condition that alerts on any successful login outside business hours to broaden coverage of the attack surface