Prioritizing Alerts Triage with Higher-Order Detection Rules

<p>At Elastic, we operate a large and diverse set of behavior detection rules across multiple datasets, environments, and severity levels. Most of these rules are atomic, each designed to detect a specific behavior, signal, or attack pattern. In addition, we ingest and promote <a href="https://github.com/elastic/detection-rules/tree/main/rules/promotions">external alerts</a> from security integrat