disable correlation rules by default

[arielkr256]

Correlation rules should only be enabled if the underlying data sources are available.

[cursor]

PR Summary

Medium Risk
Disabling correlation rules by default reduces detection coverage until operators re-enable them; standardized longer lookbacks and daily run rates also change when and how far back sequences are evaluated.

Overview
Sets Enabled: false on correlation rules across correlation_rules/ so they stay off until customers have the required underlying log sources and opt in.

Alongside that, detection scheduling is aligned: Schedule.RateMinutes is moved to 1440 and LookbackWindowMinutes to 1800 on the touched rules (replacing shorter per-rule intervals). Snowflake exfiltration correlation rules also use 1800 lookback instead of 2160.

Index/coverage updates drop entries for AWS Privilege Escalation Via User Compromise and AWS User Takeover Via Password Reset from indexes/alpha-index.md, indexes/aws.md, and indexes/detection-coverage.json.

^{Reviewed by Cursor Bugbot for commit b6bde3f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b6bde3f. Configure here.}

[cursor]

Lookback below schedule ratio minimum

Medium Severity

This change sets LookbackWindowMinutes to 1800 with RateMinutes 1440, but project guidance requires lookback at least 1.5× the run interval (2160 minutes here). That ratio avoids gaps between daily runs. The same edit also replaces attack-specific windows (e.g. OpenAI’s documented 30-minute brute-force span) with 30 hours, so re-enabling would correlate unrelated events.

Additional Locations (1)

• correlation_rules/snowflake_data_exfiltration.yml#L38-L42

 

^{Reviewed by Cursor Bugbot for commit b6bde3f. Configure here.}