Understanding correlation

What is correlation?

Correlation is the process of identifying a sequence of multiple events, across one or more devices, which are all related, and form a single large incident. The main reason correlation is so useful is because, in many cases, the individual events may not seem suspicious on their own, but when taken in relation to the other events, a larger picture emerges which points to a potential security incident.

For instance, the two events "employee logs on to Device A" and "employee logs on to Device B" seem perfectly normal.

However, "same employee logs on to two different devices (Device A and Device B) at almost the same time" may indicate a possible account sharing incident.

What is a correlation rule?

A correlation rule is a pattern or a template used to relate multiple logs and identify a security incident. The rule specifies a series of events that make up a larger incident, the time window between events, and specific conditions if any. The following illustrates the various parameters that can be specified in a correlation rule:

• Correlation rule: A correlation rule is an ordered sequence of network actions.
• Actions: An action corresponds to a network log. It contains several fields with unique values such as username, device name, and so on.
• Time window between actions: Each action has to follow the previous action within a specified time window.
• Threshold for an action (optional): A single action may have to occur several times continuously for a specific rule to hold true. A threshold can be specified for the minimum number of repetitions that need to be observed within the specified time window.
• Filters for an action (optional): Conditions can be imposed on the fields within each action, with the use of filters.

For more information on constructing a correlation rule using these parameters, see Constructing custom correlation rules.

Example:

Comparison between correlation rules and alert profiles

• A correlation rule specifies one or more events, occurring on one or more devices. An alert profile can only specify a single event, from a single device type.
• A correlation rule provides more power than an alert profile in defining a scenario. As a correlation rule can include more than one event, it allows you to specify the ordering of the events, time windows between events, and make use of various conditions.
• Threshold limits can be specified in both correlation rules and alert profiles. However, while a correlation rule can check that a specific field's value is the same throughout all repetitions of an action, an alert profile cannot.

Best practices for correlation

• Correlation is a memory intensive process. If you enable the correlation engine, be sure to enable/create rules only for your most important business use cases.
• Before creating a new rule, ensure that the same rule cannot be created as an alert profile instead. Please configure your use case as an alert profile instead of a correlation rule, if your answer is "yes" to all items in the below checklist:
  • Your use case consists of only one action.
  • You only need to specify the devices to which the use case is applicable, and don't need to check for a specific value for other fields (like username).
  • In case you specify a threshold value for the action, you don't need to check for a constant field value for any field (username, device name, etc.).
• Periodically review the logic for your correlation rules. If any rule is generating too many false positives, you can adjust the rule parameters to reduce them.

To know more about correlation, check out the following pages:

1. Managing correlation rules
2. Session activity
3. Viewing last 10 incidents
4. Creating custom correlation rules

Some examples