Definition of Event Correlation

Event correlation takes data from either application logs or host logs and then analyzes the data to identify relationships. Tools that utilize event correlation can then perform actions, such as sending alerts for hardware or application failures, based on user-defined rules.

Correlation and root-cause analysis have been stalwarts of IT performance monitoring for some time. Both practices help IT departments to determine the underlying cause of a problem and resolve it quickly to minimize any business impacts and losses.

Event Correlation Use Cases and Techniques

In essence, event correlation is a technique that relates various events to identifiable patterns. If those patterns threaten security, then an action can be imposed. Event correlation can also be performed as soon as the data is indexed. Some important use cases include:

• Data intelligence
• Operations support
• Root cause analysis
• Fraud detection

You can handle events through something as simple as sys-logging, which allows you to view new events as they arrive, but event correlation is the technique that associates varying events with one another. This is often achieved with the use of event correlation tools and alerting systems. Furthermore, correlating events can help security teams identify those that are most important.

Examples of Event Correlation

While you want to monitor events, you also want to implement automated processes that can determine relationships between complex events. One example of event correlation can occur with intrusion detection.

Perhaps there is an employee account that hasn't been accessed for years, and suddenly a large number of login attempts are noticed. That account may start executing suspicious commands. Through event correlation, an intrusion detection system can send an alert indicating that an attack is in progress.

What if among the thousands of login attempts, one was successful? Correlation then comes into play by marking this event as "curious." Then, it may notice that 15 minutes earlier, a port had been scanned. Now, it may notice that the IP address of the port scan and the login attempts are the same. This is where context is added to correlation.

Then, the event is marked with an elevated concern. These are specific events that can be related to each other – out of thousands. In fact, in any scenario, this could happen within millions of events.

If you perform manual correlation, you will have to rely on luck more than skill – because you will need to add context to the data. Furthermore, you need to see how the pieces fit together to figure out the puzzle.

Another example is incident management, where hundreds of alarms are sounded conveying that servers and related services are no longer reachable. Event correlation tools can analyze the data to determine the root cause, allowing the IT department to focus on implementing a solution rather than spending valuable time trying to pinpoint the cause.

In complex, networked environments, thousands or millions of events can be generated in just a short period of time. These events can range from critical to informational. While a good analyst can identify the root cause of failures, this type of knowledge is expensive to obtain. So, event correlation technology was designed to automate and register interrelations between ongoing events, in a more cost-effective manner.