SIEM Rule Correlation Engineering / Rule_Alert_Aggregation_By_IP · size 20 · threshold 4 · max attempts 3