Automated event correlation & incident management

As network environments scale, individual security alerts can lead to alert fatigue. Suricatavel includes an Event correlation engine and an Incident management subsystem to automatically bundle related security events, triage critical threats, and streamline the mitigation lifecycle.

---

The event correlation engine

The correlation engine continuously evaluates incoming alerts and groups them into single, actionable Incidents based on user-defined logical rules.

Correlation rules

Correlation rules define the triggers and boundaries for grouping alerts. They are configured via Administration > Correlation rules and consist of:

• Condition matching: Filters alerts based on fields like Source IP, Destination IP, Signature ID, or Alert Severity.
• Time windows: Defines how far apart alerts can be to be grouped into the same incident (e.g., within 5 minutes).
• Group keys: Specifies which fields must match to bind alerts together (e.g., group all alerts that share the same source_ip or signature_id).

Background processing

Correlation is evaluated asynchronously by the EvaluateCorrelationRulesJob queue. When a new alert batch is ingested:

1. The engine checks if the alert matches any active Correlation rule.
2. If a match is found, the engine searches for an existing, open Incident that matches the grouping keys within the rule’s time window.
3. If a matching open incident exists, the alert is automatically appended to the incident.
4. If no matching incident is found, a new Incident is created.

---

Incident management lifecycle

Once incidents are created, analysts can manage their resolution path.

Incident status flow

An incident transitions through the following statuses:

• Open: Newly created incident awaiting review.
• Investigating: An analyst has acknowledged the incident and is investigating the root cause.
• Remediated: Active mitigation measures (such as firewall IP blocks) have been applied.
• Resolved: The threat has been fully addressed.
• Closed / False positive: Dismissed as an intentional exception or false alarm.

Incident detail view

The Incidents view under Analytics > Incidents provides a dedicated investigation workspace:

• Timeline & alert relations: Inspect the chronological order of all alerts that contributed to the incident.
• Sensor metrics & network context: View CPU, RAM, and bandwidth metrics of the affected sensor around the time of the incident.
• Manual mitigation: Detach false-positive alerts, block malicious IPs on perimeter firewalls, or dispatch ticketing integration tasks directly from the incident overview.

---

Event correlation interface

Under Analytics > Event correlation, analysts can manually explore, correlate, and query security telemetry:

• Interactive query bar: Filter event streams using full-text search, logical operators, and exact field matches.
• Manual incident creation: Select multiple unrelated alerts across different sensors and bundle them into an Incident.
• Graph visualization: Examine relationships between source IPs, target IPs, and destination ports to understand the attack surface.

Beast Mode (Deep search)

For complex forensic investigations, analysts with the use_beast_mode_permission permission can activate Beast Mode via the toggle next to the query input:

• JSONB & protocol search: Enables direct queries on nested protocol metadata (such as tls.ja3.hash, http.user_agent, or dns.query.name) and raw payload snippets.
• Extended time horizons: Queries bypass standard fast aggregate limits to scan deep historical partitions.

Tip

Use standard search for routine triage and activate Beast Mode when conducting deep forensic investigations into specific protocols or advanced payloads.

Adaptive search indexes

To keep deep search fast without consuming unbounded storage, Suricatavel includes an Adaptive index engine:

• Telemetry analysis: The system records query metrics (SearchTelemetryService) and detects recurring filtering patterns.
• Partial index recommendations: When repeated filtering on specific attributes (e.g. event_type or specific JSONB attributes) is detected, Suricatavel calculates candidate partial indexes for PostgreSQL / TimescaleDB.
• Administrator control: Administrators can review recommendations, apply partial indexes, or prune unused ones using the CLI:

# Check index status and storage budget
suricatavel indexes status

# Review index recommendations based on query telemetry
suricatavel indexes analyze

# Apply recommended partial indexes
suricatavel indexes apply

# Prune unused custom partial indexes
suricatavel indexes prune