Refactor correlation template

salt/soc/defaults.yaml

@@ -2809,6 +2809,10 @@ soc:
               # Sigma correlation rule; requires ES|QL (useEsql).
               # First document: the correlation. Following documents: the rules it references.
               #
+              # This example mirrors the shipped rule c448c9f6 (Repeated SOC Login Failures For One Account).
+              # Change it before enabling, or you will get two alerts for the same activity.
+              # To test: log out of SOC and enter a wrong password 5 times for one username.
+              #
               # Types: event_count, value_count, temporal, value_sum, value_avg, value_median, value_percentile.
               # Correlation Guide: https://sigmahq.io/docs/meta/correlations.html
               # Logsources: https://sigmahq.io/docs/basics/log-sources.html
@@ -2817,46 +2821,45 @@ soc:
               id: [publicId]
               status: 'experimental'
               description: |
-                  Describe what the correlation finds and, importantly, why relating these
-                  events is more meaningful than either of them alone.
+                  Describe what the correlation finds and why relating these events is more
+                  meaningful than any one of them alone.
+                  Example: 5 or more failed SOC logins for one username in 10 minutes.
               references:
-                - 'https://local.invalid'
+                - 'https://attack.mitre.org/techniques/T1110/001/'
               author: '@SecurityOnion'
               date: '[today]'
               tags:
-                - detection.threat_hunting
-                - attack.technique_id
+                - attack.credential-access
+                - attack.t1110.001
               correlation:
-                  type: value_count
+                  type: event_count       # count the base rule's events...
                   rules:
-                      - example_base_rule  # the 'name' of the rule below
+                      - example_base_rule # ...by the 'name' of the rule below
                   group-by:
-                      - source.ip
-                  # Xs, Xm, Xh, Xd or Xw.
-                  timespan: 10m
+                      - user.name         # ...separately for each username
+                  timespan: 10m           # Xs, Xm, Xh
                   condition:
-                      field: dns.query.name
-                      gte: 40
+                      gte: 5
               falsepositives:
-                - 'Describe the benign activity that also produces this pattern'
+                - 'A user entering an old password after a password change'
               # Placeholders: %count%, %start%, %end%, %duration%, or any field.
-              summary: '%count% distinct names queried by %source.ip% in %duration%'
+              summary: '%count% failed SOC logins for %user.name% in %duration%, from %http.request.headers.x-real-ip%'
               level: 'medium'  # info | low | medium | high | critical
               ---
-              title: 'Base Event'
+              title: 'SOC Login Failure'
               # referenced by 'name' (or 'id')
               name: example_base_rule
-              description: 'The single event that the correlation aggregates.'
+              description: 'One failed SOC login. Put filters here, not in the correlation.'
               logsource:
-                category: network
-                service: dns
+                product: kratos
+                service: application
               detection:
                   selection:
-                      dns.query.name|exists: true
+                      msg: 'Encountered self-service login error.'
                   condition: selection
               # Carried into the alert.
               fields:
-                - dns.query.name
+                - http.request.headers.x-real-ip
         assistant:
           enabled: false
           investigationPrompt: Investigate Alert ID {socId}