Classification of the technology being used for the rule.
#Correlation - most common rule type. Pattern based.
Examples to review:
-> Account Locked: Domain
-> Suspicious Logon Failure without following successful login
#Correlation Using Lookup Table - also Pattern based but uses data from a Lookup table in the evaluation of the pattern. (The lookup table needs to be populated via the import button)
Examples to review:
-> Uncommon Linux process Created
-> Uncommon Server Login
#Machine Learning - References that backend AI models are being used to generate the alerts. For UEBA alerts.
Examples to review:
-> UEBA AI detects unusual file deletion
-> UEBA AI detects unusual file renamed
#Profiling - Uses the statistical baselining data to alert on a change in behaviour over time. (sqlite db)
Examples to review:
-> Sudden Increase In DNS Requests From A Specific Host
-> Sudden User Location Change
