Glossary: Vulnerability Management and Monitoring

correlation rule

Also written: correlation, correlate

An alert rule that links related events from several sources by user, address, device or time and raises one alert, such as a VPN sign-in from a new country, then a new admin account, then a large upload. Correlation is the SIEM's main strength.