From isolated events to a single attack picture
Security signals live in separate streams — an anomaly on a server here, a security alert on a device there, a deviation in a device's behavioral DNA, and an attack event caught in a trap. Each one on its own looks marginal. But a real breach is none of them individually — it's the story that unfolds across all of them. Doogree's correlation engine reads that story.
The problem: four streams, none talking to the others
Doogree already has four separate sources of truth: server anomalies, device security alerts, anomalies in a device's behavioral DNA, and attack events — honeytokens, brute-force, contact with C2. The problem is that each stream is watched in isolation: an admin sees six low alerts and marks them as noise. But those same six alerts, if you chain them together, are a scan that led to access that led to lateral movement. The noise was the attack.
The solution: correlation by entity and by time
The correlation engine runs every 5 minutes and does three things. 1. Cluster by entity. All signals from all four streams are grouped around a shared entity — a device, a server, or an attacker's IP address. 2. Cluster by time. Within a two-hour window, so that signals that are spread out but close together connect into the same story. 3. Map to kill-chain. Each signal is mapped to a coarse stage in the MITRE ATT&CK attack chain: recon → access → execution → evasion → lateral movement → C2 → impact. The result: one ongoing incident per entity, instead of a flood of alerts.
Escalation: a chain worse than any single alert
This is where the real value comes in. When several different kill-chain stages accumulate on the same entity, the engine escalates the severity automatically — a recon → access → lateral chain is far more severe than any of its links alone. And when an incident reaches high or critical, the system pushes an alert to the workspace admins and offers a containment button that acts with consent — fix-with-consent, not a blind action.
Lifecycle: from alert to closure
An incident isn't a one-time flash but a record with state: open, acknowledged, resolved. You can acknowledge, investigate, and close it — and everything is saved for the record. On top of it all runs a daily SOC digest by email that summarizes the open high/critical incidents, so that no open chain falls through the cracks.