Question

A detection engineer writes a YARA-L multi-event rule to correlate failed authentication events with subsequent successful logins for the same account. During testing against historical data, the rule times out and produces an error indicating excessive event correlation. Investigation shows the join condition only correlates events by their shared event type (metadata.event_type), not by any account or host identifier. What is the MOST likely root cause and the correct fix?

Accepted Answer

The join key has low cardinality, causing a combinatorial explosion; correlate the events on a high-cardinality field such as principal.user.userid instead of only event type.

Answer

The match window is too short; widen it to 24 hours so more events can be correlated efficiently.

Answer

The rule is missing an outcome section; add an outcome variable to aggregate the correlated events and reduce processing load.

Answer

The rule uses too many placeholder variables; consolidate them into a single match variable to lower memory usage.