What is Alert Correlation?

Individual security events are frequently ambiguous in isolation. A single failed login could be a typo. A single outbound connection to an unfamiliar external IP could be a legitimate new SaaS integration. Correlation exists to identify when several ambiguous events, taken together within a defined window, add up to something a single event never could. A representative correlation rule might fire when ten or more failed authentication attempts against one account are immediately followed by a successful login (a plausible brute-force success), and that same session subsequently touches LSASS memory (a classic credential-dumping technique), and the host then initiates connections to internal systems it has never previously contacted (lateral movement). No single stage of that chain is conclusive on its own; a failed-then-successful login happens legitimately when a user mistypes a password, LSASS access happens during normal system operations, and a host reaching a new internal peer can be routine. Together, in sequence, within a tight time window, they describe an attack chain with much higher confidence than any one stage alone.

Correlation operates across three dimensions simultaneously: time (events must fall within a sliding window, since a failed login six months before a suspicious LSASS access is unrelated noise), space (events from multiple distinct systems, endpoint, identity provider, network device, are linked as belonging to the same incident), and source type (combining network flow data, endpoint telemetry, and identity/authentication logs, since a real attack chain almost never stays confined to a single log source). SIEM correlation engines implement this with rule logic built from event filtering (narrowing to relevant event types), field extraction (pulling the hostname, username, or IP that links events together), and threshold logic (the count and timing conditions that trigger the composite alert).

Rule-based correlation has a known limitation: it can only catch chains an engineer anticipated and wrote a rule for. ML-based correlation extends this by learning what normal event sequences and volumes look like for a given environment, then flagging statistical deviations even without a predefined rule, which is how it catches novel attack chains that use techniques no analyst has seen combined that way before.