Correlation example
- Identity: suspicious authentication.
- Endpoint: new PowerShell process.
- Network: outbound connection.
- DNS: rare domain lookup.
- Analyst: determine whether these events belong to one timeline.
RR CYBERLAB • Detection & Response
XDR Correlation
Understand how XDR can connect identity, endpoint, network and other security signals into a broader investigation.
QUICK READ
XDR is valuable when multiple data sources describe different parts of the same activity. Correlation should reduce investigation gaps, not replace analyst validation.
Use this page after the daily quiz: learn the concept first, then follow the investigation workflow and examples.
Investigation workflow
- Start with the strongest signal.
- Pivot by user, host and timestamp.
- Check whether events share the same asset and session.
- Identify the sequence.
- Determine what is proven and what remains uncertain.
Why context matters
A single event may be benign. Multiple independent signals that align in time and entity can increase confidence and help prioritize investigation.Common mistakes
- Assuming correlation automatically proves compromise.
- Ignoring duplicate telemetry.
- Treating every correlated event as equally important.
Daily quiz hook
Why is correlation across identity, endpoint and network data useful during an investigation?
Quiz flow: introduce this topic briefly on social media, ask the question, reveal the answer, then send learners here for the detailed investigation.
Analyst practice note
Cross-domain correlation can connect an identity alert, endpoint process, and network event into a more useful timeline. Correlation depends on reliable identifiers, clock alignment, and source coverage; duplicates or weak matches can create a misleading story.
Review the fictional sequence and state which links are directly observed versus inferred. Confirm key joins against the original source records and report conflicting evidence instead of assuming the platform’s incident grouping is correct.
Continue practicing: open a fictional mission and test your reasoning against the simulated evidence.