A detection engineer writes a multi-event YARA-L rule to detect a process that first writes a file and then makes an outbound network connection from the same host within 10 minutes. During testing, the rule compiles but never fires, even against data the engineer knows contains both behaviors on the same host. Reviewing the rule, they notice they used two separate event variables ($file_event and $net_event) but did not correlate them on any shared field in the match section. Which change will correctly link the two events so the rule fires as intended?