Agent correlation
Separate signals recognised as one attack and grouped into an incident
Four signals from four independent sources were grouped into one incident: the email verdict (T1566.002), the unfamiliar-ASN sign-in for the same identity (T1078.002), execution on a host that identity administers (T1059.001), and the credential-dumping attempt on that same host (T1003.001) — all within a 90-minute window and sharing identity IDN-2003 and asset AST-1001.
Network beaconing analytics, endpoint memory anomaly and vulnerability timeline on the same asset were correlated into a single implant hypothesis; TI matched the destination to a known backdoor family.
Identity-provider spray analytics and MFA-prompt bursts for the same tenant within the same window were grouped; SIEM confirmed no successful authentication, which lowered the classification from High to Medium.
Endpoint recovery-inhibition telemetry, a hash match on a staged payload, an anomalous SMB pair and off-schedule service-account use on the same host were assembled into one pre-encryption staging narrative.
The NDR sweep, the preceding VPN authentication for the same identity, and the open edge-appliance finding were grouped; the contradicting endpoint signal is preserved and lowers evidence confidence rather than being discarded.
Alert & event stream
61 signals · click a row for evidence depth