Tools / Google SecOps Interview questions
What is the difference between single-event and multi-event detection rules?
A single-event rule evaluates and can trigger a detection based on just one matching UDM event, while a multi-event rule requires correlating a pattern across multiple related events — often tied together by a shared field like a user ID or source IP — before a detection fires.
| Single-Event Rule | Multi-Event Rule |
| Triggers on one matching event alone. | Requires correlating a pattern across several related events. |
| Good for detecting a clearly malicious single action. | Good for detecting a behavioral pattern over time, e.g. lateral movement. |
| Simpler to write and reason about. | Often needs the match section to define correlation grouping. |
| Typically lower computational cost to evaluate. | Typically more computationally involved, given the correlation window. |
An example of the difference in practice: a single-event rule might detect one login from a known-malicious IP address on its own, while a multi-event rule might detect the pattern of one user authenticating from two geographically distant locations within an implausibly short time window — a signal that only becomes visible once multiple related events are considered together.
What can a multi-event rule detect that a single-event rule generally can't?
What section is often needed in a multi-event rule to define correlation grouping?
More Related questions...
