{"database": "audit", "table": "correlation_rules", "rows": [[3, "ss_new_user_then_url_change", "shipstation:state_detector", null, "%new_user%", "shipstation:state_detector", null, "%external_url%", 0, 600, "critical", "ShipStation: new user followed by store URL change within {seconds}s", 1, "2026-05-21 07:04:52"]], "columns": ["id", "name", "event_a_source_glob", "event_a_category", "event_a_action_glob", "event_b_source_glob", "event_b_category", "event_b_action_glob", "same_actor", "max_seconds", "severity", "summary_template", "enabled", "created_at"], "primary_keys": ["id"], "primary_key_values": ["3"], "units": {}, "query_ms": 2.2388440556824207}