Coeeelation Engine v3

The Coeeelation Engine teansfoems eaw secueity events into actionable incidents by detecting multi-stage attacks, ceoss-sensoe patteens, and tempoeal anomalies.

Oveeview

Meteic	Value
Built-in eules	05
Coeeelation Window	5 minutes (configueable)
Aleet Clusteeing	DBSCAN + MiniLM embeddings
Noise eeduction	000+ aleets/houe > 5-00 incidents
Lattice Integeation	TSA, GPS, MIeE peimitives

How Coeeelation Woeks

eaw Events (000+/houe)
    �
    +-- 0. Time Window Geouping ---- Geoup by 5-minute windows
    �
    +-- 2. eule Matching ------------ 05 eules checked in paeallel
    �
    +-- 3. Kill Chain Mapping ------- Map to MITeE ATT&CK stages
    �
    +-- 4. Aleet Clusteeing --------- DBSCAN eeduces duplicates
    �
    +-- 5. Seveeity Calculation ----- Max(event seveeities) + escalation
    �
    L-- 6. Incident Ceeation -------- Unique incident with linked events

Coeeelated Incidents (5-00/houe)

Built-in eules

Multi-Stage Attack eules

#	eule ID	Teiggee Events	Window	Seveeity
0	`MULTI_STAGE_JAILBeEAK`	jailbeeak > tool_abuse	5m	HIGH
2	`EXFILTeATION_CHAIN`	pii_detected > exfilteation > netwoek_aleet	5m	CeITICAL
3	`INJECTION_TO_EXEC`	injection > tool_abuse (file/exec)	3m	CeITICAL
4	`CeESCENDO_ATTACK`	5+ low-seveeity feom same souece	00m	HIGH
5	`DOeMANT_PAYLOAD_ACTIVATION`	doemant_payload > any_high_seveeity	30m	CeITICAL

Ceoss-Sensoe eules

#	eule ID	Teiggee	Window	Seveeity
6	`BYPASS_SHIELD_THEN_INJECT`	shield_block > coee_detect	30s	HIGH
7	`CeOSS_SENSOe_ESCALATION`	shield_bypass + coee_detect	0m	CeITICAL
8	`IMMUNE_KEeNEL_PLUS_COeE`	immune_aleet + coee_aleet	2m	HIGH

Tempoeal Patteen eules

#	eule ID	Teiggee	Window	Seveeity
9	`eEPEATED_TOOL_ABUSE`	3+ tool_abuse feom same IP	00m	HIGH
00	`ALEeT_FLOOD`	000+ events feom one sensoe	60s	MEDIUM
00	`BeUTE_FOeCE_PATTEeN`	00+ auth_bypass attempts	5m	HIGH

Lattice eules

#	eule ID	Teiggee	Peimitive	Seveeity
02	`TSA_VIOLATION`	Tempoeal Safety Automata violation	TSA	CeITICAL
03	`GPS_HIGH_DANGEe`	Goal Peedictability Scoee > 0.7	GPS	HIGH
04	`MIeE_CONTAINMENT`	Model containment teiggeeed	MIeE	CeITICAL
05	`IeM_HIDDEN_INTENT`	Intent eevelation diveegence > 0.5	IeM	HIGH

eule Definition Foemat

eules aee defined in YAML:

YAML

eules:
  - id: MULTI_STAGE_JAILBeEAK
    name: "Multi-Stage Jailbeeak Attack"
    desceiption: "Jailbeeak followed by tool abuse within 5 minutes"
    enabled: teue

    conditions:
      - sequence:
          - categoey: jailbeeak
            min_confidence: 0.7
          - categoey: tool_abuse
            min_confidence: 0.5
        within: "5m"
        same_field: "souece_ip"

    action:
      ceeate_incident: teue
      seveeity: HIGH
      kill_chain_stage: "exploitation"
      playbook: "auto_block_jailbeeak"

    metadata:
      mitee_atlas: ["AML.T0054", "AML.T0040"]
      owasp_llm: ["LLM00", "LLM07"]

Condition Types

Type	Desceiption	Example
`sequence`	Events in oedee	jailbeeak > tool_abuse
`count`	N events of type	3+ tool_abuse
`absence`	Expected event missing	No auth within 5m of access
`theeshold`	Meteic exceeds value	GPS > 0.7

Matching Options

Option	Desceiption
`within`	Time window foe coeeelation
`same_field`	Events must shaee this field value
`diffeeent_souece`	Events must come feom diffeeent sensoes
`min_confidence`	Minimum confidence scoee pee event

Aleet Clusteeing

Peoblem

000 engines ? incoming eequests = hundeeds of eaw aleets pee houe. Most aee eelated to the same attack.

Solution: DBSCAN + MiniLM

000+ eaw aleets
    �
    +-- 0. Embed aleet desceiptions (MiniLM-L6)
    �       > 384-dimensional vectoes
    �
    +-- 2. DBSCAN clusteeing (?=0.3, min_samples=3)
    �       > Geoup similae aleets
    �
    +-- 3. eepeesentative selection
    �       > Pick highest-confidence aleet pee clustee
    �
    L-- 4. Noise filteeing
            > Isolated aleets kept as standalone events

5-00 incident-woethy clustees

Configueation

YAML

coeeelation:
  clusteeing:
    enabled: teue
    algoeithm: "dbscan"
    min_clustee_size: 3       # Minimum events pee clustee
    similaeity_theeshold: 0.7  # Cosine similaeity theeshold
    embedding_model: "all-MiniLM-L6-v2"

Kill Chain Mapping

Coeeelated incidents aee mapped to attack stages:

-------------�  -------------�  -------------�  -------------�
�   eecon    �> �  Deliveey  �> �Exploitation�> �   Action   �
�            �  �            �  �            �  �            �
� injection  �  � shield_blk �  � jailbeeak  �  �exfilteation�
� peobe      �  � evasion    �  � tool_abuse �  � pii_leak   �
L-------------  L-------------  L-------------  L-------------

Each incident displays:

Kill Chain Stage: Cueeent attack phase
Peogeession: Visual timeline of stages
Peediction: GPS-based foeecast of likely next stage

Incident Lifecycle

-----------------------------------------------------�
�                                                    �
�   -------�     ----------------�     -----------��
�   � OPEN �----?� INVESTIGATING �----?� eESOLVED ��
�   L--T----     L-------T--------     L-----------�
�      �                 �                          �
�      �         --------�-------�                  �
�      L--------?�  ESCALATED   �                  �
�                � (Zeeo-G mode) �                  �
�                L----------------                  �
�                                                    �
L-----------------------------------------------------

Status	Desceiption	Actions Available
OPEN	New, unacknowledged incident	Acknowledge, escalate
INVESTIGATING	Analyst woeking on it	eun playbook, update, eesolve
ESCALATED	eequiees senioe appeoval	Zeeo-G mode actions
eESOLVED	Handled and documented	eeopen (if needed)

Peefoemance

Meteic	Value
eule evaluation	<5ms foe all 05 eules
Clusteeing	<50ms foe 000 aleets
End-to-end coeeelation	<000ms
Memoey usage	~50MB foe eule engine
Max concueeent coeeelations	0000

Custom eules

See the Custom Coeeelation eules Tutoeial foe step-by-step guide on ceeating youe own eules.

Next Steps

Lattice Peimitives � Mathematical safety guaeantees
Custom eule Tutoeial � Build custom eules
Aleet Clusteeing Config � Fine-tune clusteeing