Overview
Correlation links related events across logs to detect activity no single event reveals. This lesson covers SIEM correlation.
Learning objectives
- Define correlation in a SIEM.
- Explain correlation rules.
- Connect correlation to higher-confidence detection.
Core concept
Correlation is linking multiple related events — often across different sources — to detect activity that no single event reveals. A SIEM applies correlation rules that match patterns spanning events: for example, "many failed logins followed by a success from the same source" (a possible brute-force + compromise), which needs several events linked by shared fields (module 4) and time (timestamps). Correlation is the SIEM's power beyond single-event alerting: it detects patterns and sequences indicative of threats, and enables higher-confidence detections by combining signals. It's the realization of the cross-source correlation enabled by normalized fields and synchronized timestamps.
How it works
A correlation rule in the SIEM defines a pattern across events — matching on shared field values (e.g. same user, IP, host) and often time windows (using normalized timestamps). When the sequence/pattern occurs, the rule fires an alert. Examples: repeated failures then a success (brute-force compromise); a login followed by unusual activity; the same suspicious indicator appearing in multiple sources. Correlation combines weak individual signals into a stronger, higher-confidence detection, and catches multi-step activity that single-event rules miss. This depends on the normalization and parsing done earlier (consistent fields) and synchronized timestamps (reliable time relationships). Correlation is central to the SIEM's detection value — turning a stream of individual events into detection of meaningful, threat-indicative patterns.
Practical example
A SIEM correlation rule watches for a pattern: many failed logins for an account followed by a successful login from the same source IP within a short window. Individually, a failed login or a success is unremarkable; correlated, the sequence suggests a brute-force that succeeded (possible account compromise), and the SIEM alerts with higher confidence. The rule relied on shared fields (user, source IP — from parsing/normalization) and time (synchronized timestamps). Correlation combined weak signals into a meaningful detection no single event would have revealed — its core value.
Cybersecurity relevance
Correlation is the SIEM's core detection power: linking related events (across sources, by shared fields and time) detects patterns and sequences — like brute-force-then-success — that no single event reveals, and combines weak signals into higher-confidence detections. It realizes the cross-source correlation enabled by normalized fields (module 4) and synchronized timestamps, and depends on reliable parsing. Correlation catches multi-step threats and reduces reliance on single-event alerts. It underpins much of the detection covered in later modules (malware, phishing, auth anomalies, intrusion). Correlation turns a stream of individual events into detection of meaningful, threat-indicative activity — central to effective monitoring.
Common mistakes
- Relying only on single-event alerts, missing multi-step patterns correlation catches.
- Poorly-designed correlation rules (too broad → noise; too narrow → misses).
- Correlation broken by bad parsing/normalization or clock skew (inconsistent fields/time).
Key takeaways
- Correlation links multiple related events (across sources, by shared fields and time) to detect patterns no single event reveals, via correlation rules.
- It combines weak individual signals into higher-confidence detections and catches multi-step activity single-event rules miss (e.g. brute-force then success).
- It depends on normalization, parsing, and synchronized timestamps; correlation is the SIEM's core detection power, underpinning later detection modules.
Check your understanding
- What does a correlation rule do, and why is correlation more powerful than single-event alerting?
- What does reliable correlation depend on (fields, time)?