What is a correlation rule?¶

A correlation rule is a detection rule that links multiple events or conditions to identify a wider pattern.

It is intended to recognise activity that may not appear significant when each event is viewed alone.

Avoid the dangerous assumption¶

The dangerous assumption is that correlated events automatically prove one person, one cause or one incident.

They do not.

A correlation rule might link failed logins followed by success, a new device followed by a permission change or network activity followed by an endpoint detection.

The rule may connect events using account names, device identifiers, IP addresses, session IDs or a time window. Each of those links has limitations.

The same account may be shared. An IP address may represent many devices. Events occurring close together may be unrelated. Missing records can also cause the rule to connect only part of the picture.

Correlation rules are valuable because they can reveal sequence and context across several systems. But the result remains an analytical interpretation created by configured logic.

Investigators should obtain the rule logic, matching fields, time window, exclusions, source systems and version. Ask whether one alert can contain several event groups or whether duplicate events may have influenced the result.

Examine each underlying event and test the claimed relationship. Establish whether the identifiers genuinely refer to the same account, device, session or process.

Do not confuse correlation with causation. The fact that events were linked by a rule does not prove that one caused another or that the same person controlled them.

Operational takeaway¶

A correlation rule links events according to configured identifiers and timing, but investigators must verify the relationship and must not treat correlation as automatic proof of causation, identity or a single incident.