Detection and Correlation Rules in SIEM¶

Think of a SIEM (Security Information and Event Management system) as a giant security camera system for your network. It collects logs from everywhere (computers, servers, firewalls) and tries to figure out if something suspicious is happening.

Detection Rules¶

Detection rules are simple conditions that tell the SIEM what to look for.

Example:

Alert me if there are 5 failed login attempts in 1 minute.

These rules usually look at one type of event at a time. Think of it like:

“If someone enters the wrong password too many times, that’s suspicious.”

Correlation Rules¶

Correlation rules are more advanced. They connect multiple events together to find bigger threats.

Instead of looking at one thing, they ask:

> “Do these different events, when combined, mean something bad is happening?”

Example:

Failed login attempts
Then a successful login
Then access to sensitive files

A correlation rule might say:

“If all 3 happen in a short time → alert (possible account compromise).”

Analogy¶

Detection rule = noticing one weird thing → “That’s odd.”
Correlation rule = connecting multiple weird things → “Okay, something is definitely wrong.”

Why It Matters¶

Detection rules = basic defense
Correlation rules = real threat hunting

Most real attacks aren’t obvious in one event—they show up as patterns over time.

Real-World Example¶

Imagine a hacker:

Tries passwords (failed logins)
Gets in (successful login)
Downloads a lot of data

A beginner SIEM might alert only on step 1. A smarter SIEM with correlation connects all steps → flags a data breach attempt.

Summary¶

Detection rules = simple, single-event alerts
Correlation rules = combine multiple events to detect real attacks
Correlation is what makes a SIEM actually powerful

SIEM Detection & Correlation Quiz¶

What is the main purpose of a SIEM system?
1. To store large files
2. To collect logs and detect suspicious activity
3. To speed up the internet
4. To design network diagrams
A detection rule in a SIEM is designed to:
1. Connect multiple events together
2. Trigger an alert on a single suspicious event
3. Delete old logs
4. Prevent hackers automatically
Which of the following is an example of a correlation rule?
1. Alert if one login attempt fails
2. Alert if 5 failed logins happen, then a successful login, then access to sensitive files
3. Alert if a file is downloaded
4. Alert if the server is turned on
Why are correlation rules more powerful than detection rules?
1. They are easier to write
2. They connect multiple events to find patterns
3. They store logs more efficiently
4. They work only on firewalls
Which analogy is correct?
1. Detection rule = “That’s odd.” Correlation rule = “Something is definitely wrong.”
2. Detection rule = “Something is definitely wrong.” Correlation rule = “That’s odd.”
3. Detection rule = “Store logs.” Correlation rule = “Analyze CPU usage.”
4. Detection rule = “Design network.” Correlation rule = “Write code.”