Skip to main content

Incident correlation

Escalated alerts rarely arrive alone: a brute-force burst, a lateral-move chain, or a noisy misconfiguration produces dozens of related escalations. The incident layer turns them into one reviewable object.

From escalation to incident​

  1. Grouping. Escalated alerts are keyed by what they have in common, which is the environment, the entities involved, and the time window. Each one then either joins an existing open incident or opens a new one.
  2. L2 review. A deeper analysis pass reads the incident as a whole: it can consolidate, re-score, summarize the story so far, and flag what deserves human eyes first.
  3. Lifecycle. Incidents carry a status, accumulate member alerts as the situation evolves, and keep the complete decision trail of every member.

When an incident opens​

Correlation runs automatically right after every triage pass, with no button to press. It reads the freshly triaged alerts and groups them per agent, and an incident opens once the evidence on one agent adds up to something that has to be read as a whole. Activity spanning more than one stage of an attack counts, and so does a run of high-priority findings. A finding severe enough on its own opens one too, including from a source that carries no attack-technique tagging.

An agent's existing incident is updated in place instead of creating duplicates.

What you see in the console​

The incidents view is designed to be the first screen an analyst opens:

  • Incidents ranked by risk, each with a summary, its member alerts, and the MITRE techniques involved.
  • The timeline of how the incident grew: which alert opened it, what joined, what L2 concluded.
  • Actions: resolve, keep watching, or trigger incident response.

An incident is described by four independent values: evidence verdict, severity, evidence strength, and response priority. Reaching a confirmed verdict takes hands-on verification. How to read all of that: Reading an incident.

Why correlation matters​

Without it, an agentic SOC would move alert fatigue one step downstream, to a hundred escalations instead of a thousand alerts. Correlation is what makes the output fewer, better objects rather than slightly filtered noise.