Correlation Engine Rules
Active Rules Hierarchy
| Rule ID | Name | Detection Logic | Severity Output | Status | Actions |
|---|---|---|---|---|---|
| R1 | SSH Brute Force | 3+ failed logins from same IP in 5 mins | High | ● Active | |
| R2 | Sensitive File Scan | 403 errors on .env or config files | Medium | ● Active | |
| R3 | SQL Injection | WAF detects SQL keywords in URI | Critical | ● Active |