Multistage rules are an extension of rules in Helix Enterprise that allow you to create chains of rules that can detect threats across multiple event logs before generating an alert. Multistage rules include assertions, dependencies, or both and may generate alerts.
You can use assertions and dependencies in multistage rules to create sets of rules to detect multiple-stage malware, exploit kit detection, password brute force attacks, shellshock exploitation attempts, and more.
Multistage rules rely on assertions and dependencies to perform complex event matching. You can read more about how assertions and dependencies function in Assertions and dependencies.
The following sections explain how to create multistage rules. An example of building a multistage rule is provided in Multistage rules example: Detecting common exploit kit redirect attempts.