Question

A detection engineer is authoring a YARA-L multi-event rule that fires when a single user authenticates from three or more distinct source IP addresses within 15 minutes. During test runs against historical data, the rule generates correct detections, but the security analysts complain that each alert only shows one source IP in the alert details, making triage difficult because they cannot see the full set of IPs that contributed to the detection. Which change to the rule best resolves this without altering the detection logic or threshold?

Accepted Answer

Add an outcome variable using array_distinct() on the source IP field (e.g., $ip_list = array_distinct($e.principal.ip)) so all contributing IPs are captured and surfaced in the detection.

Answer

Change the match window from 15 minutes to 60 minutes so more events are grouped together, exposing additional IPs in the alert.

Answer

Remove the match section entirely and convert the rule to a single-event rule so each source IP produces its own alert.

Answer

Add a repeated string modifier to the source IP placeholder variable in the events section to force all values into the detection.