Here we can see that this rule is applicable to over 200 events, one of which is already under review. By being able to see this level of detail within the alert logic, we can perform bulk levels of triage, making the entire process more effective and more efficient, and in turn reducing the dwell time of adversarial
activity.

Click on the blank space to the left of the TIR to go back