Writing Detection Rules That Actually Catch Something: A Walkthrough of Real SPL Queries

In Part 2, you learned to build SPL searches in layers. In Part 3, you learned how correlation searches connect separate signals into a meaningful pattern, using a condition, a time window, and an act