What is the most effective way to correlate multiple raw events coming from a SIEM and link them together?

Question

Mustapha Amine Atmani · Accepted Answer

Configure a pre-process rule to link related events as they are ingested

Mustapha Amine Atmani · Answer

Process all alerts by running the respective playbook and link related incidents during postprocessing

Mustapha Amine Atmani · Answer

Ingest all raw events, run a custom script to find the relationship between them and proceed to link them together

Mustapha Amine Atmani · Answer

Manually go through the incidents created by the raw events and link related incidents

List of questions