{"database": "audit", "table": "correlation_rules", "rows": [[5, "ct_unauthorized_then_cf_state", "cloudflare:ct_logs", null, null, "cloudflare:state_diff", null, null, 0, 3600, "critical", "CT log entry followed by Cloudflare config change within {seconds}s", 1, "2026-05-21 07:04:52"]], "columns": ["id", "name", "event_a_source_glob", "event_a_category", "event_a_action_glob", "event_b_source_glob", "event_b_category", "event_b_action_glob", "same_actor", "max_seconds", "severity", "summary_template", "enabled", "created_at"], "primary_keys": ["id"], "primary_key_values": ["5"], "units": {}, "query_ms": 1.7003631219267845}