Each cloud tenant is control-plane isolated — its audit stream never touches another tenant's. A correlation engine sitting above all of them can still link events that share a signature (technique fingerprint, C2 indicator hash) if they land inside a shared time window:
flag campaign ⇔ |{ tenants with signature s in window W }| ≥ T
That rule is powerful — a coordinated attacker hitting many tenants with the same signature is easy to spot even though each tenant's own SOC sees only one quiet event. But it can also fire on pure coincidence. For n tenants and an alphabet of s signatures, the chance that a *specific* signature is drawn independently by T particular tenants is (1/s)^T; summed over all s possible signatures that collapses to (1/s)^(T-1), and summed (Bonferroni-style) over every one of the C(n,T) possible T-tenant subsets gives the working approximation used here:
P(coincidence, one check) ≈ C(n,T) · (1/s)^(T−1)
Fix applied vs. the source 3D model: the original formula carried a stray extra factor of s — C(n,T)·s·(1/s)^(T−1) — which pushes the estimate above 1 (impossible for a probability) whenever the threshold is low. Verified numerically: for n=5, s=8, T=3, direct Monte-Carlo simulation of 2,000,000 random draws gives ≈0.128, the corrected formula gives ≈0.156 (a safe Bonferroni upper bound, since it double-counts overlapping subsets), while the uncorrected formula gives 1.25 — an impossible value. This engine plots the corrected curve.
- Tenants / regions — how many isolated environments feed the correlation engine.
- Campaign rate — how often a real coordinated attacker injects the same signature into several tenants in quick succession.
- Signature alphabet — how many distinct technique fingerprints exist; a smaller alphabet means more accidental overlap.
- Correlation window — how long an event stays "live" for matching purposes.
- Correlation threshold — how many distinct tenants must share a signature before the engine raises an alert.
Real-world relevance: this is the same principle behind cross-account threat-intel correlation in cloud SOC platforms (shared IOC feeds across otherwise-isolated tenants) and behavioral baselining across tenants/regions used in real cloud detection-and-response programs.