Event correlation
- Description
-
A method that uses patterns to find relationships between events from different sources, such as applications, devices, and operating systems. It allows you to take remedial action when correlation rules identify a pattern that poses a security threat.
Most SIEMs are capable of correlating events. However, performing event correlation at the log collection level can be more practical, as it minimizes the data sent to your SIEM, thereby reducing log noise, network traffic, and costs. NXLog Agent can correlate events using the Event Correlator processor module. Along with the NXLog language, it provides the tools you need to correlate events at the log collection stage.
- Also known as
-
log event correlation, log data correlation
- See also