{"database": "audit", "table": "correlation_rules", "rows": [[1, "bc_login_to_perm_grant", "bc:account", "login", "%", "bc:account", "permission", "changed", 1, 300, "warning", "BC chain: actor {actor} logged in, then granted permission within {seconds}s", 1, "2026-05-21 07:04:52"]], "columns": ["id", "name", "event_a_source_glob", "event_a_category", "event_a_action_glob", "event_b_source_glob", "event_b_category", "event_b_action_glob", "same_actor", "max_seconds", "severity", "summary_template", "enabled", "created_at"], "primary_keys": ["id"], "primary_key_values": ["1"], "units": {}, "query_ms": 2.319555962458253}