A SIEM correlation rule triggers an alert when a single source IP generates 10 or more failed authentication attempts against the same user account within any 5-minute sliding window. The following failed login events are logged for user "jsmith" from one IP address: 3 attempts at 09:00, 4 attempts at 09:01, 2 attempts at 09:03, and 3 attempts at 09:05. Did the correlation rule trigger, and why?
- AYes, because the very first 3 attempts at 09:00 alone exceeded the threshold
- BNo, because only 3 attempts occurred at 09:05, which is below the threshold
- CNo, because a correlation rule requires attempts from multiple source IP addresses
- DYes, because 12 failed attempts occurred within the 09:00–09:05 five-minute window, exceeding the threshold
Show answer & explanationAnswer & explanation
Correct answer: D. Yes, because 12 failed attempts occurred within the 09:00–09:05 five-minute window, exceeding the threshold
Summing attempts within the 5-minute window from 09:00 to 09:05 gives 3+4+2+3 = 12 failed attempts, which meets and exceeds the threshold of 10, so the rule triggers. Evaluating only the last timestamp in isolation (option B) or the first timestamp alone (option C) ignores the sliding window aggregation the correlation rule is designed to perform.
Why the other options are wrong
- A. 3 attempts at 09:00 alone do not meet the 10-attempt threshold by itself.
- B. Looking at only the 09:05 timestamp ignores the cumulative sliding window count.
- C. The rule as described is based on a single source IP, not multiple IPs.
SIEM Correlation Rule Thresholds
A rule that aggregates related events (e.g., failed logins) over a defined time window and triggers an alert once a cumulative threshold is met, rather than evaluating single events in isolation.
- Uses sliding time windows to sum related events
- Reduces noise compared to alerting on every single event
- Threshold tuning balances detection speed vs false positives
Memory trick: The SIEM keeps a running tally in a moving 5-minute basket — once it's full (10), the alarm rings.