Elastic's Higher-Order Rules correlate alerts across entities, data sources, and time windows to surface higher-confidence detections and reduce triage noise. This approach enriches endpoint alerts with network and observability telemetry (examples: Elastic Defend, Palo Alto/ FortiGate, Suricata) to catch complex activity like the XZ Utils backdoor incident and improve prioritization. #XZUtils #ElasticDefend