Event information is correlated to support incident analysis by identifying patterns, trends, and other common features
Context and Guidance: Event correlation may help identify issues that may be more serious than when events are considered independently. For example, brute force attacks can be obfuscated by conducting them from multiple machines, thereby circumventing traditional lockout rules for 3 or 5 failed logins from a single IP address. And the issue is recognised as a more serious issue only when taken in a larger context. Event correlation requires the comparison of two or more events and establishes potential relationships between events. These are examples of correlation activities: • Viewing and comparing separate events from the same information source • Viewing and comparing separate events from different information sources • Viewing and comparing events over time for common characteristics