Sigma now has the concept of Correlated detections. https://sigmahq.io/docs/meta/correlations.html 👍 this issue if you'd like to see support for it! It would take quite a bit to support it in Sigmalite currently, but it's conceivable that we could support it in some way.