Building a Detection for a Database Server That Phones Home

I wrote my first detection rule this weekend. The most useful thing I learned wasn’t how to write it. It was why my first version didn’t…