## Advanced Correlation: Risk-Based Alerting (RBA)

Traditional correlation ("3 failed logins = Alert") generates too much noise. **RBA** is the modern approach managed by Advanced SOCs.

### The Concept
Instead of triggering an alert *immediately*, we assign **Risk Points** to an entity (User or System).

*   **Rule 1**: User triggered "Possible Phishing Link". (Confidence: Low).
    *   Current Logic: Alert Analyst -> False Positive 90%.
    *   RBA Logic: Add **+10 Risk Points** to User. (No Alert).
*   **Rule 2**: User triggered "Unusual PowerShell". (Confidence: Medium).
    *   RBA Logic: Add **+30 Risk Points** to User.
*   **Rule 3**: User triggered "Data Upload to Personal Cloud". (Confidence: Low).
    *   RBA Logic: Add **+20 Risk Points** to User.

### The Threshold Alert
*   **Total Risk Score**: 10 + 30 + 20 = **60**.
*   **Threshold Rule**: "Alert when Risk Score > 50".
*   **Result**: The analyst gets ONE high-fidelity alert ("User with Risk 60") that tells the whole story, instead of 3 low-fidelity alerts.

### Implementing Kill Chains
Advanced correlation tracks the sequence.
`transaction` command in Splunk loops events together by ID.
*   If `Event A` (Firewall Permit) AND `Event B` (IDS SQL Injection) occur within 10 seconds...
*   Combine them into a generic "Exploit Attempt" meta-event.

### Statistical Anomaly Detection (Standard Deviation)
*   Calculate the average daily outbound traffic for `Payroll_Server` over 30 days (`avg=50MB`, `stdev=10MB`).
*   **Rule**: Alert if Today > `avg + (3 * stdev)`.
*   (If today represents 80MB, that's 3 sigmas away—statistically extremely rare).
*   *Advantage*: You don't need to know the *exact* number; the math finds the outlier for you.