ConceptsCorrelation Detection

Correlation Detection

A detection technique that combines multiple events or signals, across logs, hosts, or time, to identify a threat that no single event would reveal, such as a failed-login burst followed by a success and unusual data access.

Glossary definition

7 direct links1 lesson

Concept Neighborhood

Explore this concept’s connections in the groups below.

PrerequisiteRelated

Start here

Detection Hypothesis

The foundation Correlation Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Detection HypothesisStart here

A testable idea about how a specific attacker behavior would appear in available data, which a detection engineer forms before building a detection, stating what to look for and in which telemetry.

lessons

Relatedsorted by lesson coverage

Detection Lifecycle

lessons

Detection Robustness

lessons

Detection Specificity

lessons

Cross-Source Correlation

lessons

Authentication Anomaly Detection

lesson

Collection

lesson

Related Lessons

1 lesson covers this concept

Common Detection Patterns

SOC Analyst