AI Agent Security (Course)
Sequence Rule
Also: cross-event detection
A detection that fires when related events occur in a particular order in one session, such as a credential read followed by network use.
In more detail
Single-event rules look at one command at a time. A sequence rule examines a recent window of events from the same session and reports when a pair or chain appears, which suits attacks made of individually normal steps. It records a correlation, not a fact: it does not show what data was sent or whether delivery succeeded, and it can miss a chain if some events were never captured. It is evidence for a human to review.