Jump to content

Alert correlation

Edit links
From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Utcursch (talk | contribs) at 11:48, 5 January 2012 (added Category:Computer systems using HotCat). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Alert correlation is a type of log analysis. It focuses on the process of clustering alerts (events), generated by [Network intrusion detection system|NIDS]] and [[Host-based intrusion detection system|HIDS] computer systems, to form higher-level pieces of information.

Example of simple alert correlation is grouping invalid login attempts to report single incident like "10000 invalid login attempts on host X".

See also

Retrieved from "https://en.wikipedia.org/w/index.php?title=Alert_correlation&oldid=469698723"