Skip to main content

Incident correlation

Escalated alerts rarely arrive alone: a brute-force burst, a lateral-move chain, or a noisy misconfiguration produces dozens of related escalations. The incident layer turns them into one reviewable object.

From escalation to incident​

  1. Grouping. Escalated alerts are keyed by what they have in common — the environment, the entities involved, and the time window — and either join an existing open incident or open a new one.
  2. L2 review. A deeper analysis pass reads the incident as a whole: it can consolidate, re-score, summarize the story so far, and flag what deserves human eyes first.
  3. Lifecycle. Incidents carry a status (open → in review → resolved), accumulate member alerts as the situation evolves, and keep the complete decision trail of every member.

When an incident opens​

Correlation runs automatically right after every triage pass — there is no button to press. It reads the freshly triaged alerts, groups them per agent, and opens an incident when any of three signals fire in the window:

  • two or more distinct MITRE tactics on one agent — coordinated activity, not a repeated rule;
  • three or more alerts at high or urgent priority;
  • a single urgent-priority alert — so a lone critical from a source that lacks MITRE tagging still opens one.

An agent's existing incident is updated in place instead of creating duplicates.

What you see in the console​

The incidents view is designed to be the first screen an analyst opens:

  • Incidents ranked by risk, each with a summary, its member alerts, and the MITRE techniques involved.
  • The timeline of how the incident grew — which alert opened it, what joined, what L2 concluded.
  • Actions: resolve, keep watching, or trigger incident response.

An incident is described by four independent values — evidence verdict, severity, evidence strength, and response priority — and reaching a confirmed verdict takes hands-on verification. How to read all of that: Reading an incident.

Why correlation matters​

Without it, an agentic SOC would just move alert fatigue one step downstream — a hundred escalations instead of a thousand alerts. Correlation is what makes the output fewer, better objects rather than slightly filtered noise.