gensecaihq/wazuh-autopilot/alert-correlation

Alert Correlation

Goal: answer "is this isolated, or part of something bigger?" NIST CSF 2.0 DE.AE — correlating adverse events from multiple sources.

Procedure

1. get_case — collect entities (IPs, users, hosts, hashes) and first/last alert time.
2. Pick a window: default ±24h around the case; widen to 7d for slow activity

(password spraying, beaconing) or narrow to ±1h for bursts.

1. Pivot on each attacker/victim entity (max 10 pivots per run — prioritize attacker IPs,

then targeted users, then hosts).

1. Aggregate to find patterns rather than reading raw alerts one by one.
2. Classify the result (table below) and record it.

Query patterns

Results come back as "<Label>:\n{json}" with items under data.affected_items. Keep compact=true (the default), keep limit ≤ 500 per query, and narrow by time or agent rather than paging through thousands of alerts. Load wazuh-mcp-querying for more.

Correlation signals

• Same source, many targets → scanning / spraying / worm-like spread.
• Many sources, same target → distributed brute force / DDoS-like.
• Same user, many hosts in short time → lateral movement or credential reuse.
• Tactic progression on one entity (Recon → Initial Access → Execution → Persistence

→ Privilege Escalation → Lateral Movement) → active intrusion; raise severity.

• Same hash / domain across hosts → campaign or malware spread.
• Periodic identical events (fixed interval) → beaconing or scheduled task.

Classification

Merge rather than duplicate: if search_cases finds another open case with the same entities, reference it in your finding so a human can merge.

Output

• add_entities for newly discovered related entities (validated).
• link_mitre for newly observed techniques.
• update_case severity/confidence if changed.
• add_finding titled Correlation results: window used, pivots run, classification,

related alert counts per entity, related case ids. standard_refs: NIST-CSF-2:DE.AE.