The Dark Art of Alert Correlation- Extracting Attack Chains from Chaos

The talk opens with a familiar SOC problem: log volumes are enormous, most of the data is audit or telemetry, and the few events that reflect real attacks get lost in the noise. The speaker argues that cost pressure pushes teams to split data between a SIEM and cheaper storage, which adds complexity and makes cross-source correlation harder. Multi-stage intrusions that span months and many endpoints are, in this view, poorly served by brittle correlation rules.

The proposed approach runs in stages before data reaches the SIEM. A small language model tags each event with a MITRE ATT&CK technique, related records are clustered into groups, and redundant entries are aggregated and deduplicated. Grouped behaviors are then linked into ordered attack flows that show progression through the kill chain. A worked example follows one intruder's reconnaissance and later installation across several data source types, presented as one context instead of scattered alerts.

The speaker claims volume reductions around 90 percent without losing data, which would cut costs more than moving data to other stores, and presents the work as an open-source tool. Little evaluation detail was given, so the savings figures are unverified in the talk. The practical takeaway is to test whether aggregating redundant records inside your existing SIEM can reduce volume before adding another data platform.