Event correlation is the combined analysis of logs from different sources, such as firewalls, servers and endpoints, to find patterns that look harmless on their own but together reveal an attack. It is usually performed by a SIEM (security information and event management) platform using rules and behavioral models. For example, ten failed logins followed by a successful one from another country trigger an alert.
How TecnetOne handles it: TecnetSOC
log correlation, SIEM correlation, correlation rules, security event correlation, correlation engine