{"database": "audit", "table": "correlation_rules", "is_view": false, "human_description_en": "", "rows": [[1, "bc_login_to_perm_grant", "bc:account", "login", "%", "bc:account", "permission", "changed", 1, 300, "warning", "BC chain: actor {actor} logged in, then granted permission within {seconds}s", 1, "2026-05-21 07:04:52"], [2, "bc_perm_grant_to_app_install", "bc:account", "permission", "changed", "bc:account", "app", "installed", 1, 600, "warning", "BC chain: actor {actor} was granted permission, then installed app within {seconds}s", 1, "2026-05-21 07:04:52"], [3, "ss_new_user_then_url_change", "shipstation:state_detector", null, "%new_user%", "shipstation:state_detector", null, "%external_url%", 0, 600, "critical", "ShipStation: new user followed by store URL change within {seconds}s", 1, "2026-05-21 07:04:52"], [4, "dsm_authfail_then_advisor", "dsm:auth", null, "%fail%", "dsm:advisor:summary", null, null, 0, 1800, "warning", "DSM: auth failure followed by Security Advisor severity update within {seconds}s", 1, "2026-05-21 07:04:52"], [5, "ct_unauthorized_then_cf_state", "cloudflare:ct_logs", null, null, "cloudflare:state_diff", null, null, 0, 3600, "critical", "CT log entry followed by Cloudflare config change within {seconds}s", 1, "2026-05-21 07:04:52"], [6, "bc_perm_change_then_app_remove", "bc:account", "permission", "changed", "bc:account", "app", "removed", 1, 1800, "info", "BC chain: actor {actor} changed permission, then removed app within {seconds}s", 1, "2026-05-21 07:04:52"]], "truncated": false, "filtered_table_rows_count": 6, "expanded_columns": [], "expandable_columns": [], "columns": ["id", "name", "event_a_source_glob", "event_a_category", "event_a_action_glob", "event_b_source_glob", "event_b_category", "event_b_action_glob", "same_actor", "max_seconds", "severity", "summary_template", "enabled", "created_at"], "primary_keys": ["id"], "units": {}, "query": {"sql": "select id, name, event_a_source_glob, event_a_category, event_a_action_glob, event_b_source_glob, event_b_category, event_b_action_glob, same_actor, max_seconds, severity, summary_template, enabled, created_at from correlation_rules order by id limit 51", "params": {}}, "facet_results": {}, "suggested_facets": [], "next": null, "next_url": null, "private": false, "allow_execute_sql": true, "query_ms": 6.6201339941471815}