A rule should evaluate normalized event fields across supported source types. Which approach best fits?

1. Use a supported multi-event YARA-L rule with shared identity variables and a match window.
2. Define the supported rule match window and aggregation conditions.
3. Write detection logic against the appropriate UDM field semantics.
4. Use stable appropriate correlation fields and validate the joins.