// Investigation
Detection engineering
Correlation rules evaluated against the event stream. Disabling a rule stops it raising alerts but preserves the alerts it has already produced.
19rules19armed1ATT&CK tactics covered
Rule library
1 of 19 rules shown
| Armed | Rule | Severity | Category | ATT&CK | Alerts |
|---|---|---|---|---|---|
| Impossible travel The same account authenticating from two countries closer together in time than travel between them would allow. Strong evidence that a credential is being used by someone other than its owner. | Critical | Credential Access | T1078.004Initial Access | 1 |