Question

A detection engineer writes a multi-event YARA-L rule in Google SecOps to correlate a failed login followed by a successful login from the same user. The rule compiles but returns zero detections during a live test against data the engineer knows contains matching activity. The engineer's rule uses a `match` section listing `$user` over a 10-minute window, but in the `events` section only the failed-login event assigns `$user = $e1.principal.user.userid`, while the successful-login event references a different placeholder `$account` for its userid field. What is the most likely reason the rule produces no detections, and the correct fix?

Accepted Answer

The two events are never correlated because the join key is broken; both events must bind the same variable (e.g., $user) to their respective userid fields so the match section can group them.

Answer

The match window of 10 minutes is too short; extending it to 60 minutes will allow the events to correlate regardless of the placeholder mismatch.

Answer

The rule needs an outcome section to compute a risk score before the match section can group events; adding $risk_score resolves the correlation.

Answer

Multi-event rules cannot correlate authentication events by userid; the engineer must switch to a single-event rule using the any/all operators.