Expand correlation rules with sequence, group, and absence logic

[jusso-dev]

Problem

The current correlation helpers cover threshold and sequence detection basics, but analysts need a stronger model for multi-step behavior, grouped signals, and expected-but-missing activity.

Scope

Extend correlation rules to support sequence rules, group rules, minimum match count, match fields, lookback windows, ingest-latency tolerance, and absence-of-signal conditions.

Implementation Notes

• Add a correlation rule manifest shape under the detection pack model.
• Support sequence, group, minMatchCount, matchFields, lookbackWindowMinutes, ingestLatencyMinutes, and absence.
• Correlation should operate over persisted signals once first-class signals exist.
• Before persisted signals are available, support an adapter over current retained records and summary outputs.
• Add rule tests with relative timestamps.
• Add a simple visualization panel showing stages, transitions, and match fields.

Acceptance Criteria

• A group rule can match any 2 of 3 configured signal types.
• A sequence rule can require ordered activity within a window.
• A rule can match when one expected follow-up signal is absent.
• Match fields ensure stages belong to the same user, host, IP, or process where configured.
• Tests can be defined with relative timestamps and expected outcomes.

Tests

• Unit test group minMatchCount.
• Unit test ordered sequence matching.
• Unit test absence-of-signal matching.
• Unit test match-field tenant isolation.
• Snapshot or component test correlation visualization renders stages.