Alert correlation

From HandWiki
Revision as of 07:37, 27 June 2023 by John Stpola (talk | contribs) (correction)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Short description: Type of log analysis

Alert correlation is a type of log analysis. It focuses on the process of clustering alerts (events), generated by NIDS and HIDS computer systems, to form higher-level pieces of information.

Example of simple alert correlation is grouping invalid login attempts to report single incident like "10000 invalid login attempts on host X".

See also



Retrieved from "https://handwiki.org/wiki/index.php?title=Alert_correlation&oldid=3007895"