SIEM Rule Correlation Engineering / Wazuh_FIM_Correlation_Critical_Files · size 20 · threshold 4 · max attempts 3