Due to the large amount of legitimate activity matching this technique, you can link multiple granular, timebased correlation rules to effectively identify malicious activity. For example, if there are multiple discovery