## The Magic of Correlation: Finding the Needle in the Stack

Correlation is the brain of the SIEM. It is the logic engine that evaluates millions of individual events to identify patterns that indicate a security incident.

Without correlation, you just have a massive library of boring journals. Correlation is the detective reading all those journals to solve the crime.

### The Logic of Correlation rules
A correlation rule generally follows this Boolean logic structure:
**IF** (Condition A) **AND** (Condition B) **HAPPENS WITHIN** (Time Window T) **THEN** (Trigger Alert).

#### Example 1: Brute Force Detection
*   **Raw Event**: Windows Event 4625 (Failed Login).
*   **Problem**: Users mistype passwords all the time. One event is noise.
*   **Correlation Rule**:
    *   `event_id=4625` (Failed Login)
    *   `count > 10`
    *   `distinct_destination_user < 2` (Standard Brute force) OR `distinct_destination_user > 10` (Password Spraying)
    *   `time_window = 5 minutes`
*   **Meaning**: If the same IP fails to login 10 times in 5 minutes, ALERT.

#### Example 2: The "Impossible Travel"
*   **Event A**: User "Alice" logs in from New York (IP 1.2.3.4) at 10:00 AM.
*   **Event B**: User "Alice" logs in from London (IP 5.6.7.8) at 10:15 AM.
*   **Logic**: Distance between NY and London is 3,400 miles. It is impossible to travel that fast.
*   **Rule**: IF (Login A success) AND (Login B success) AND (GeoIP distance > 500 miles) AND (Time difference < Flight time) -> ALERT.

#### Example 3: Behavioral Chain (The Kill Chain)
*   **Step 1**: Firewall detects Port Scan from IP X.
*   **Step 2**: IDS detects SQL Injection attempt from IP X.
*   **Step 3**: Web Server records 200 OK (Success) for a large file download to IP X.
*   **Correlation**: Trigger "Critical Compromise" alert. A single IP scanned, exploited, and stole data.

### Tuning: The Analyst's Nightmare
Correlation rules are prone to two deadly sins:

#### 1. False Positives (The Boy Who Cried Wolf)
The rule alerts, but it's benign activity.
*   *Alert*: "Brute Force Detected!"
*   *Reality*: A script running on a server had an expired password and tried to retry connection 50 times in a second.
*   *Consequence*: Alert Fatigue. Analysts stop paying attention to alerts if 90% are fake.

#### 2. False Negatives (The Silent Killer)
The attack happens, but the rule doesn't trigger.
*   *Attack*: Low-and-slow brute force. The attacker tries 1 password every hour.
*   *Rule Limitation*: The rule was set to "10 attempts in 5 minutes". It missed the attack completely.
*   *Consequence*: Breach.

### Dynamic vs. Static Correlation
*   **Static**: Rules we explicitly write (`count > 10`). Good for known threats.
*   **Dynamic (Heuristic/Behavioral)**: The system learns what is "normal".
    *   "Alice usually downloads 50MB of data a day. Today she downloaded 5GB. ALERT."
    *   This catches "unknown unknowns" or zero-days that don't match a signature.

### The Role of Context
Correlation gets smarter with context.
*   *Event*: "Attack from External IP detected against Server A."
*   *Context*: "Server A is a test server with no sensitive data." -> **Low Severity**.
*   *Context*: "Server A is the CEO's laptop." -> **High Severity**.
*   *Context*: "Vulnerability Scanner says Server A is patched against this attack." -> **False Positive (mostly)**.

A modern SIEM integrates with Asset Management and Vulnerability Scanners to enrich alerts with this context automatically.