What are SIEM correlation rules, and provide an example of a rule that detects anomalous authentication behavior?

• A. They link events to produce higher-level alerts; example: trigger if a user experiences multiple failed logins from one country followed by a successful login from a different country within a short window
• B. They store raw log data for audit trails; example: all login attempts
• C. They generate reports on network latency
• D. They enforce access controls via policy

Answer: (A)

SIEM correlation rules connect related events from different sources to raise alerts when a meaningful pattern is detected. They don’t just store or display logs; they look for relationships, sequences, and thresholds across multiple events and time windows, so a single unusual spike in logs doesn’t have to be acted on in isolation.

The example illustrates a pattern that often signals compromised access: several authentication failures from one country followed by a successful login from a different country within a short period. By encoding this as a correlation rule, the system can flag the sequence as suspicious rather than treating each event as separate activity. This helps security teams respond quickly to potential credential stuffing, account compromise, or suspicious access behaviors that wouldn’t be evident from a single event alone.

Other options describe different activities that aren’t about linking events to detect patterns—storing raw log data is about data collection, reporting on network latency is about performance, and enforcing access controls is about policy governance. None of those involve the cross-event reasoning that defines correlation rules.