Related events arrive as one chain instead of separate tickets.
The three arrive as one incident on one account, inside one window, in the order they happened.
Detect, correlation and attack chains
A login, a role grant and a consent look harmless one at a time.
How it works
Correlation on time, on order, on how often and on how many distinct values
Impossible travel is computed from real geography, flagging journeys that would need more than 500 km/h
Rapid IP switching and legacy authentication downgrades are correlated per user and per address
Ask the specialist that owns this work.
Ask in your own words. The Threat Triage Agent runs as you, and any action it can take ships off until an admin turns it on.
Threat Triage Agent
Groups related alerts into one investigation and tells you which of them are justified benign noise.
- You asked: Is the alert on Jaime Rivera worth waking someone for?
Nuvio answered: The five alerts on Jaime Rivera inside thirty minutes are one chain. I merged them into one investigation and put it first in your queue.
Ready for youOpen INC-1107
Detect, investigations