# 🔗 Correlating Events

A single log is a dot. Correlation connects the dots to make a picture.

## 📝 The Raw Logs (Sequence)

```text
[09:00:01] Failed Login (User: Bob, IP: 10.0.0.50)
[09:00:02] Failed Login (User: Bob, IP: 10.0.0.50)
[09:00:03] Failed Login (User: Bob, IP: 10.0.0.50)
... (50 more times)
[09:01:00] Successful Login (User: Bob, IP: 10.0.0.50)
[09:01:05] User Created (User: Admin2, By: Bob)
```

## 🕵️‍♂️ Investigation Steps

### Step 1: Brute Force
* The first block is a classic brute force attack.

### Step 2: The Breakthrough
* `[09:01:00]`: The attack succeeded. They guessed the password.

### Step 3: Persistence
* `[09:01:05]`: The very first thing the attacker did was create a BACKDOOR user (`Admin2`).
* **Why**: Even if Bob changes his password, the attacker can still login as Admin2.

### Step 4: The Correlation Rule
* `Trigger Alert IF (Failed_Login > 10 in 5 mins) FOLLOWED BY (Successful_Login)`.
