| 摘要 |
A system and method for enhancing event correlation with exploitation of external data is presented. A correlation engine receives events and selects a correlation rule that corresponds to the events. The correlation rule includes an event selection, a trigger condition, and a correlation conclusion. The correlation engine uses the event selection to access external data and select events based upon the external data. In turn, the correlation engine monitors the selected events and checks whether they meet the correlation rule's trigger condition. When the events meet the correlation rule's trigger condition, the correlation engine performs an action based upon the correlation rule's correlation condition.
|
