Track a key the engine can supply on three correlations

[NRGLine4Sec]

after: track by_username groups on the username Sagan resolved for the event. Three rules ask for it without giving the engine any way to resolve one: no json_map: "username", no normalize. The key is then empty for every event, they all share one counter, and the rule counts globally instead of per user.

Measured against Sagan built from 3b9b0fa, each arm sending the count the rule asks for:

rule events ships patched
5008553 one user, one address alert alert
5008553 a different user each time alert alert
5008553 a different address each time alert silent
5008760 one user, one address alert alert
5008760 a different user each time alert alert
5008760 a different address each time alert silent

The third row is the defect: twenty-five failures spread across twenty-five hosts and twenty-five accounts raise "Possible Windows Broken Domain Trust", which is the shape the rule exists to rule out. sid 5008760 does the same on five unrelated RDPV.exe events, and its threshold: type limit tracks the same empty key.

Both rules already carry parse_src_ip: 1, so by_src is a key the engine fills. If the source carries a user field these rules should bind it with json_map: "username" instead, which is the better fix and needs someone who knows the schema.

sid 5015220 is the same shape with no consequence: it tracks by_src&by_username and binds src_ip, so the empty half changes nothing and the rule already groups per address, which is what its own title says. The dead half is dropped so the line reads as it behaves. Measured: identical on all three arms, before and after.

All three have their rev incremented.