David works as the Security Manager for ABC Inc. He has been assigned a project to detect the attacks over multiple connections and sessions and to count the number of scanned ports in a defined time period.
Which of the following rulebases will he use to accomplish the task?