A rule must correlate a failed-login sequence and a successful login for the same principal within a defined interval. Which approach best fits?

1. Use a supported multi-event YARA-L rule with shared identity variables and a match window.
2. Write detection logic against the appropriate UDM field semantics.
3. Define the supported rule match window and aggregation conditions.
4. Use stable appropriate correlation fields and validate the joins.