A SIEM correlation rule misses an after-hours brute-force chain

Raw events arrive, but the analytic never fires because time bucketing no longer aligns with the intended incident window.