{"database": "audit", "table": "correlation_rules", "rows": [[4, "dsm_authfail_then_advisor", "dsm:auth", null, "%fail%", "dsm:advisor:summary", null, null, 0, 1800, "warning", "DSM: auth failure followed by Security Advisor severity update within {seconds}s", 1, "2026-05-21 07:04:52"]], "columns": ["id", "name", "event_a_source_glob", "event_a_category", "event_a_action_glob", "event_b_source_glob", "event_b_category", "event_b_action_glob", "same_actor", "max_seconds", "severity", "summary_template", "enabled", "created_at"], "primary_keys": ["id"], "primary_key_values": ["4"], "units": {}, "query_ms": 1.6522938385605812}