What a correlation is
Correlation runs alongside detection. It links recent alerts that share entities such as a host, a user or an address, and groups two or more of them into a correlation. A correlation keeps its identity as new alerts join it.
Entity risk
Each entity has a risk score built from the alerts it appears on over the last seven days, weighted by severity and recency. The Entity risk tab on the Correlations page lists the riskiest entities in your scope with the alerts behind the number.
Working a correlation
Open a correlation to see its member alerts, the entities they share and a graph linking them. From there:
- Promote to case: creates one case covering every member alert.
- Assign member alerts or change their stage. Changes apply to the alerts themselves.
- Open any member to work it individually.
Incidents
In the console, incident means a case and nothing else. Correlations are the clustering layer; cases are the workspace.