stateful-rule-designer

What problem does it solve?

Correlate multi-event sequences over time, track parent-child relationships, and count occurrences to enable advanced stateful D&R rule design.

Core Features & Use Cases

• Correlate parent-child process relationships across multiple events to identify attack chains.
• Count events within defined time windows to detect threshold-based threats.
• Support nested stateful logic and complex event relationships for advanced detections.
• Provide testing and troubleshooting guidance to validate rules before deployment.

Quick Start

Define a stateful rule that detects a specific parent process launching a designated child within a short window and test it with synthetic events.