VERISCO Alertio Correlate
Correlation patterns
The seven patterns Alertio uses to recognise an attack across several alerts, the three ways a pattern can match, and what each one looks for.
A correlation pattern describes the shape of an attack. When the alerts for one entity match a pattern, Alertio opens an incident.
Three ways to match#
| Match type | Fires when |
|---|---|
| Ordered sequence | Given kill-chain stages appear in order. Other events may sit between them, because real attacks are noisy. |
| Count | One stage repeats a set number of times within a time window. |
| Severity | A single alert the rule itself rates critical maps to an attack stage. The safety net for the one decisive event a chain would miss. |
The patterns#
| Pattern | Type | Looks for |
|---|---|---|
| Multi-Stage Attack | Ordered sequence | Reconnaissance, then credential access, then impact. |
| System Compromise | Ordered sequence | The full intrusion: reconnaissance, exploitation, privilege escalation, impact. |
| Scan and Exploit | Ordered sequence | Reconnaissance against an entity, followed by exploitation attempts. |
| Lateral Movement | Ordered sequence | Credential access, a pivot to another host, then impact. |
| Credential Attack | Count | A burst of failed authentications from one entity in a short window: brute force or password spray. Successful sign-ins are not counted. |
| Targeted Exploitation | Count | Repeated exploitation attempts against one entity in a short window: injection, traversal or scanner traffic. |
| Critical Attack Alert | Severity | One alert its rule rates critical that maps to an attack stage. |
Extending the library#
New patterns can be added for your environment without changing the correlation engine, so a new pattern never disturbs the ones you already rely on. Talk to us about the attacks you want recognised.
Patterns and the queue#
An alert that belongs to an open incident is admitted to the Triage Queue whatever its own score. This is why correlation matters for triage: a quiet reconnaissance alert that would be suppressed alone reaches the analyst once it is part of an attack.
Something missing or wrong on this page? Tell us and we will fix it.