Question

A detection engineer writes a YARA-L multi-event rule to detect brute-force authentication by correlating failed logins from a single source IP against multiple usernames. During testing, the rule fires a separate detection for every additional failed login beyond the threshold within the same match window, flooding the SOAR queue with near-duplicate alerts for the same attack episode. The engineer wants exactly one detection per source IP per match window while preserving the multi-username correlation logic. Which change best achieves this?

Accepted Answer

Add a `match` section keying on the source IP over the desired time window so events are grouped into a single detection per key per window

Answer

Convert the rule to a single-event rule so each failed login is evaluated independently and only the first is alerted

Answer

Lower the `#user_count` distinct threshold in the condition to reduce the number of qualifying events

Answer

Add a `not` condition to the events section to exclude successful logins from the correlation