Jump to content

Alert correlation

Edit links
From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Baszerr (talk | contribs) at 11:37, 5 January 2012 (short description of alert correlation). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.
(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff)

Alert correlation is a type of log analysis. It focuses on the process of clustering alerts (events), generated by [Network intrusion detection system|NIDS]] and [[Host-based intrusion detection system|HIDS] computer systems, to form higher-level pieces of information.

Example of simple alert correlation is grouping invalid login attempts to report single incident like "10000 invalid login attempts on host X".

See also

Retrieved from "https://en.wikipedia.org/w/index.php?title=Alert_correlation&oldid=469697469"