ASSURED

Attack chains and multi-event correlation

The strategy: think in sequences, not moments

Most attacks are not a single dramatic action. They are a sequence of small actions that together describe a progression: reconnaissance, then Initial Access The first step of a breach, where attackers gain a foothold in the environment through phishing, exploits, credential abuse, or exposed services. , then Privilege Escalation Gaining access at a higher trust level than the actor originally held, by any means: exploiting a bug, abusing a misconfiguration, stealing credentials, impersonating a token, or socially engineering an elevation. , then Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. , then Exfiltration The unauthorized transfer of data from a system or network, often as part of a data breach or espionage operation. . Multi- Event Correlation The process of analyzing multiple events across different sources to identify relationships and determine if they are part of a larger security incident. is the validation strategy designed to catch that shape, not just the single suspicious moment in the middle.

As a validation strategy, chain thinking is a question the analyst asks of every alert: is this event one step in a sequence? Answering it means pivoting outward from the alert (same host, same account, adjacent time windows, related techniques) and assembling the timeline by hand. When a platform has already assembled the sequence, the result arrives as a behavioral alert and the analyst’s job is to confirm the narrative. This page is about the same thinking applied by the analyst directly, especially for the chains no engine has a pattern or a window for.

The dimensions of correlation

Whether an engine assembles the chain or the analyst does, it links events across four correlation dimensions. During validation, pivot along each. A useful chain typically involves at least two of them.

🕐 Time

Events grouped within a window. The window can be minutes for fast attacks like ransomware staging, or hours-to-days for slow-and-low intrusions. Search in both directions: the alert in front of you may be the first, middle, or last visible step.

📍 Assets

Events that touch the same host, account, segment, or service. Pivot on the entities the events share, so a lateral movement chain shows the host and account hops in order.

🛠️ Technique

Events that map to the same MITRE ATT&CK technique or category. Differentiates living-off-the-land behavior from custom malware. Helps attribute a chain to a campaign.

🎯 Targeting

Events that focus on a department, a data type, or a class of user. Helps the analyst recognize when a chain is an opportunistic intrusion versus a targeted one.

Representative platforms: IBM QRadar Enterprise SIEM with real-time correlation, ML-assisted prioritization, and broad ecosystem integration. , Exabeam Next-gen SIEM with built-in UEBA; user-behavior timelines and automated investigation workflows. Fusion, Google Security Operations (formerly Chronicle) Cloud-native security analytics platform from Google Cloud; high-speed search and threat detection at petabyte scale. Chronicle was folded into the Google Security Operations (Google SecOps) brand in 2024. (formerly Chronicle), Splunk Enterprise Security Premium SIEM on the Splunk platform; correlation searches, ML, prebuilt content for SOC workflows. , Microsoft Sentinel Cloud-native SIEM/SOAR (formerly Azure Sentinel); AI-driven analytics across on-prem, cloud, and hybrid with rich connector library, plus a built-in UEBA module for user and entity behavior analytics. correlation rules.

Correlation's sibling: grouping and dedup

One underlying activity rarely produces one alert. A single malicious download can fire the EDR’s signature engine, the proxy’s reputation check, the IDS rule, and the SIEM correlation built on top of all three. Before chaining events into a sequence, group the alerts that are the same event seen by different sensors: same entity, same artifact, overlapping timestamps. Counting one activity four times inflates severity, and investigating it four times wastes three analysts. Most SIEM/SOAR stacks do first-pass grouping automatically; the analyst owns the final judgment on what is a duplicate versus a genuinely new observation.

Example: a chain no single rule catches

The fast version of chain detection is already covered: the rule-based example shows a single SIEM rule catching an Office-macro chain because all three steps land on one host within 28 seconds. This example is the other kind, the kind that validation strategy exists for.

Case study

A week of quiet steps on one account

None of these events produced a high-severity alert. Two were logged without alerting at all. The chain only exists if someone assembles it.

What happened around the account j.moreau over eight days:

Day 1  09:14  VPN login from a residential ISP in a new city
              Low-severity geo alert, auto-closed by playbook

Day 3  22:47  SMB share enumeration across two file servers
              Logged by EDR; below alerting threshold

Day 6  21:03  New service account created: svc-backup-2
              Change-audit event; no ticket referenced

Day 8  02:19  svc-backup-2 compresses 4 GB from a finance share
              and uploads it to a personal cloud-storage domain
              Medium-severity DLP alert on the upload only

The Day 8 Data Loss Prevention (DLP) A set of tools and processes that help prevent sensitive data from being lost, stolen, or compromised. alert is the only thing in front of the analyst. Validated in isolation, it reads like an employee misusing personal storage: a policy violation, not an intrusion.

The chain is what changes the verdict. Pivoting on the account, and then on the service account it created, connects four events that no rule linked: they span eight days (longer than any correlation window configured in the SIEM), four data sources (VPN, EDR, change audit, DLP), and two identities. A rule that alerted on any single step would drown the SOC in false-positives, and a rule tuned to the whole sequence would be too specific to ever fire again. This shape of intrusion is only caught by an analyst who asks what sequence the alert in front of them belongs to.

What the analyst checks while assembling the chain:

  • The initial access. Was the Day 1 VPN login protected by MFA, and did it come from a device the User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. had used before? The authentication logs answer whether the account was already compromised before anything else happened.
  • The enumeration scope. Which shares did the Day 3 activity touch? If the Day 8 upload came from a share enumerated on Day 3, coincidence becomes sequence.
  • The service-account creation. Who authorized svc-backup-2? An unreferenced change that stages data two days later is the strongest link in the chain, and it pivots the investigation onto a second identity.
  • The destination. WHOIS Protocol and database of domain registration data; used to investigate suspicious domains and attribution. data, DNS prevalence, and Threat An actor (or capability) with intent and means to cause harm. A vulnerability is what they exploit. Classical risk models multiply threat, vulnerability, and impact; ASSURED's RATM folds the threat and vulnerability questions into likelihood, so risk stays impact times likelihood. - Intelligence Information gathered and analyzed to understand and predict potential security threats. overlap for the cloud-storage domain, plus one wider question: has any other account in the environment sent data there?
What makes the chain stronger than the parts

Each event in the example had a plausible legitimate explanation on its own: people travel, admins enumerate shares, service accounts get created, employees misuse personal storage. The chain is stronger than the sum of the parts because the combination (new-location access, then enumeration, then unauthorized account creation, then staging and egress, all traceable to one identity) describes a progression with intent. Correlation, whether an engine runs it inside a window or an analyst runs it across a week, is the strategy that surfaces these combinations without a hand-crafted rule for every permutation.

Operational practice

  • Tune and validate correlation rules on a regular cadence. A correlation rule that worked well last quarter may fire on legitimate activity this quarter as the environment shifts.
  • Keep long-term retention and consistent Normalization Converting logs and events from different sources into a common field schema so a username, IP, or timestamp means the same thing regardless of which tool recorded it. SIEM correlation rules and cross-source queries depend on it; fields that were never normalized are where searches silently miss. to support multi-step analysis. A four-hour chain requires four hours of consistently shaped data.
  • Integrate Endpoint A device that initiates network connections and runs user-facing software: laptop, desktop, server, phone, tablet. Endpoints are where most adversary tradecraft eventually shows up, which is why EDR exists. , network, and identity Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. . Correlation lives at the seams between data sources. A chain that crosses three sources is far more informative than one within a single source.
  • Provide real-time processing capacity. Batch-only correlation misses the speed window during which response is most effective.

Key Takeaway

Attack-chain correlation is the strategy that catches the attacks no single event would catch. Platforms assemble the chains they have patterns and windows for; the analyst assembles the rest by pivoting on time, assets, technique, and targeting. Used well, it turns validation from “is this one event bad?” into “what sequence is this event part of?”, and that is the question intrusions actually fail.

Next up

Asset and user criticality

The third strategy: weigh alerts by what they could affect and who is involved.

Read criticality