A rule matches unrelated events because it joins only on a common generic process name. Which approach best fits?

1. Write detection logic against the appropriate UDM field semantics.
2. Use a supported multi-event YARA-L rule with shared identity variables and a match window.
3. Use stable appropriate correlation fields and validate the joins.
4. Define the supported rule match window and aggregation conditions.