Correlation Rule

Definitions

1. A detection rule that links multiple events, signals, or patterns together to identify behavior that would not be obvious from any single alert alone. Correlation rules are common in SIEMs and other central monitoring platforms.

   In plain English: A rule that combines multiple signals to detect suspicious activity more intelligently.

   Example: "The SIEM's correlation rule tied VPN login anomalies to unusual admin actions and raised the case severity immediately."

Related Terms

• Anomaly Detection
• Behavioral Analysis
• Device Fingerprinting
• Fingerprinting
• IP Reputation
• Security Information and Event Management
• User and Entity Behavior Analytics
• Behavioral Detection