{"database": "audit", "table": "correlation_rules", "rows": [[6, "bc_perm_change_then_app_remove", "bc:account", "permission", "changed", "bc:account", "app", "removed", 1, 1800, "info", "BC chain: actor {actor} changed permission, then removed app within {seconds}s", 1, "2026-05-21 07:04:52"]], "columns": ["id", "name", "event_a_source_glob", "event_a_category", "event_a_action_glob", "event_b_source_glob", "event_b_category", "event_b_action_glob", "same_actor", "max_seconds", "severity", "summary_template", "enabled", "created_at"], "primary_keys": ["id"], "primary_key_values": ["6"], "units": {}, "query_ms": 1.6819329466670752}