Overview#
An intelligence analyst reviewing a financial crime case notices three alerts on three separate accounts. Each looks routine in isolation. But when you map the shared IP address, the synchronised timing, and the identical structuring amounts, what looked like noise becomes a coordinated fraud ring operating across multiple cells. Correlation analysis turns that insight from a lucky observation into a repeatable, automated process.
The Alert Correlation Analysis & Campaign Detection module transforms fragmented security alerts into actionable intelligence by automatically identifying relationships between seemingly unrelated alerts, detecting coordinated attack campaigns, and creating investigation cases. Multi-dimensional correlation works across entity attributes, temporal patterns, behavioural similarities, and threat intelligence indicators simultaneously. The result is faster response to attacks that would otherwise appear as isolated incidents scattered across analyst queues.
Key Features#
- Multi-Dimensional Cross-Alert Correlation: Matches alerts sharing common identifiers, temporal proximity, behavioural patterns aligned to attack frameworks, threat intelligence indicators, and geographic proximity. Every correlation carries an explainable confidence score so analysts know why alerts were linked together.
- Temporal Pattern Analysis: Sliding window analysis across multiple time horizons detects attack sequences, velocity anomalies, dormancy patterns between campaign stages, and predicts likely next stages based on observed progression.
- Entity Grouping and Relationship Mapping: Graph-based relationship discovery maps connections between entities across alerts with community detection, centrality scoring, multi-hop relationship queries, and relationship strength assessment. Complex networks of related actors become navigable.
- Campaign Detection and Attribution: Matches behavioural signatures against curated threat intelligence, clusters alerts by tactics and techniques, provides multi-factor attribution confidence scoring, and tracks campaign evolution over time.
- Automated Case Creation: Groups correlated alerts into investigation cases based on confidence thresholds, with dynamic priority calculation, automated analyst assignment, evidence preservation through Digital Notary cryptographic signing, and pre-populated investigation templates.
- Predictive Forecasting: Anticipates likely next attack stages based on observed campaign progression patterns, giving defenders time to prepare before the next phase executes.
- Threat Actor Profiling: Maintains adversary profiles with capability assessments that improve attribution accuracy and inform investigation priorities as new alerts arrive.
- Cross-Tenant Threat Detection: Identifies identical attack patterns across multiple environments, enabling proactive defense by distributing indicator packages to unaffected organisations before they become targets.
Use Cases#
- Detecting multi-stage fraud campaigns where coordinated account takeover attempts generate dozens of separate alerts over multiple days. Correlating login anomalies, bypass attempts, and withdrawal requests creates a single campaign view for comprehensive response rather than dozens of disconnected tickets.
- Revealing APT lateral movement across authentication, network traffic, and privilege escalation alert categories. Relationship mapping shows the full scope of compromised systems and movement paths, not just the most recently triggered rule.
- Uncovering organised crime networks by cross-case analysis of shared identifiers across seemingly separate financial crime investigations, revealing coordinated operations that individual case owners would never see.
- Enabling managed security service providers to identify attack patterns across multiple client environments and proactively push indicators to unaffected clients before those clients are targeted.
Integration#
The module connects with SIEM platforms, endpoint detection tools, network security systems, cloud security services, email security platforms, SOAR platforms for automated response, and collaboration tools for notifications. It supports STIX/TAXII threat intelligence formats and both commercial and open-source intelligence feeds. Compliance alignment covers SOC 2 Type II, ISO 27001, PCI DSS, GDPR, and NIS2 Directive requirements.
Open Standards#
- OASIS STIX 2.1: Correlated alerts and threat intelligence indicators are exported as STIX 2.1 bundles (Indicator and Report SDOs), and inbound STIX 2.1 objects from feeds are parsed and matched against alert entities during correlation.
- OASIS TAXII 2.1: Threat intelligence feeds are ingested via a TAXII 2.1 client that polls analyst-configured collections, supplying the indicator data against which campaign signatures are matched.
- MITRE ATT&CK: Attack patterns and campaign attribution use MITRE ATT&CK technique identifiers (T-numbers) to classify tactics and techniques, enabling clustering of alerts by adversary behaviour.
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): Evidence preservation for correlated alert clusters uses RFC 3161 trusted timestamp authority tokens, cryptographically proving that evidence existed at a specific point in time for legal admissibility.
- ISO 19005-3 (PDF/A-3): Investigation case exports are rendered as PDF/A-3 archival documents with embedded JSON metadata and a Merkle root hash, producing court-admissible evidence packages.
- CACAO v2.0 (Collaborative Automated Course of Action Operations): Response playbooks triggered by campaign detection are stored and exchanged in CACAO v2.0 JSON format, enabling interoperable automated response workflows.
- TLP (Traffic Light Protocol): STIX marking-definition references for TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, and TLP:RED are applied to exported intelligence packages to govern information-sharing boundaries.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14