high severity incident
Correlation rules or used cases