Alert Correlation

Correlation is the process of connecting related alerts to see the complete picture of an attack. A single alert rarely tells the full story.

Why Correlation Matters

Attackers don't operate in isolation:

Phase 1: Phishing email → User clicks link
Phase 2: Malware downloads → XDR detects process
Phase 3: C2 beacon → Firewall sees connection
Phase 4: Lateral movement → SIEM logs authentication
Phase 5: Data theft → Firewall sees large upload

Each phase generates alerts. Correlation connects them.

Correlation Indicators

IP Address

Same source or destination IP across alerts:

• External IP contacting multiple hosts
• Internal IP making unusual connections
• Known bad IP appearing in multiple logs

User Account

Same user in multiple suspicious events:

• Failed logins → successful login → privilege escalation
• Normal user suddenly accessing sensitive systems
• Service account used interactively

Hostname/Endpoint

Multiple alerts from the same system:

• Process execution → file creation → network connection
• Login → process → data access chain
• Endpoint showing signs of compromise

Time Window

Events occurring close together:

• Alerts within minutes of each other
• Sequence suggesting attack progression
• Burst of activity followed by quiet

IOCs (Indicators of Compromise)

Shared technical indicators:

• Same file hash across endpoints
• Common domain in network logs
• Matching process names or paths

Correlation Groups

When alerts are correlated, they form a correlation group:

Using Correlation in SOC Simulator

SIEM View

1. Click on an alert
2. Check the "Related Alerts" section
3. View the correlation timeline
4. See shared IOCs

Correlation Timeline

Visual representation showing:

• When each alert occurred
• How alerts relate to each other
• The attack progression

Correlation Graph

Network-style view showing:

• Alerts as nodes
• Connections between them
• Central indicators (IPs, users, etc.)

Tips for Better Correlation

1. Pivot on IOCs - Search for IPs, users, hashes across all logs
2. Expand timeframe - Look 30 minutes before and after
3. Check all tools - SIEM might miss what XDR catches
4. Follow the chain - Initial access → execution → persistence → etc.

Correlation Scoring

SOC Simulator scores your correlation ability:

Practice Exercise

When you see an alert:

1. Note the key IOCs (IP, user, hostname, hash)
2. Search for each IOC in other alerts
3. Build a timeline of events
4. Determine if it's isolated or part of a chain
5. Assess the full scope before making a triage decision