thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Correlation Rule

SIEM logic that combines multiple events, possibly across sources and time, to identify suspicious patterns.

Definition

Correlation rules detect sequences such as multiple failed logins followed by a success, or a malware alert followed by outbound traffic to a rare domain. They use time windows, thresholds and joins across data sources. Poorly designed rules cause alert fatigue.

Example

Alert when one source has more than 20 failed logins and then a success within 10 minutes.

Exam tip

Correlation is what distinguishes a SIEM from simple log storage.

Related terms