Skip to main content

Event Correlation

Single events rarely tell the whole story. Correlation links related telemetry and, when needed, multiple alerts so analysts can understand an activity chain instead of chasing isolated records.

What correlation does​

  • Groups events from the same process tree
  • Connects child activity to the original triggering process
  • Preserves time order across the alert sequence
  • Adds supporting context such as file, registry, and network actions
  • Produces a cleaner alert object for analysts and AI workflows
  • Combines selected alerts into a broader incident narrative when the activity appears connected

Multi-alert correlation​

Multi-alert correlation is used when several detections may belong to the same suspicious sequence. The backend combines the selected alerts into one context so the analyst can review the activity as a single incident instead of separate rows.

Multi-alert correlation output

This output helps analysts move from separate event review to a single incident view. It is especially useful when execution, reconnaissance, persistence, and network activity are distributed across multiple alerts.

Example investigation pattern​

  1. A document spawns powershell.exe.
  2. PowerShell downloads a script.
  3. The script writes a file to a temporary directory.
  4. A new outbound connection appears shortly after execution.
  5. Correlation groups the sequence into a single alert story.

Process tree view​

Process tree analysis

This view shows how the dashboard presents:

  • Parent-child process lineage
  • The order of execution across the chain
  • The exact process where the alert was triggered