SOAR Alert Correlation Engine 2D: Union-Find Incident Clustering

Alert Stream

Arrival rate 6 / s

Correlation threshold 0.55

Dedup time window 20 s

Rule weighting

SOC Readouts

Alerts ingested

Open incidents

Dedup reduction

Avg incident size

0.0

Raw alert (uncorrelated)
Correlated incident cluster

How it works

A SOAR platform never hands an analyst raw alerts one-by-one — it first runs a correlation engine that scores every new alert against recent ones and merges matches into a single incident, using union‑find:

score = w_ip · sameSubnet + w_asset · sameAsset + w_t · max(0, 1 − Δt / window)
if score ≥ threshold:  union(newAlert, matchedAlert)

Arrival rate — how many raw alerts per second the simulated SIEM emits into the engine.
Correlation threshold — the minimum score for two alerts to be folded into the same incident cluster. Lower it and unrelated alerts start merging (false correlation); raise it and near-duplicates stay split (analyst fatigue).
Dedup time window — how far apart in time two alerts can still count as related; correlation credit decays linearly to 0 at the window edge.
Rule weighting — which signal dominates the score: shared source subnet, shared target asset, or a balanced mix of subnet + asset + time proximity.

Each dot is one raw alert; same-color clusters pulled to a shared point are alerts the engine has unioned into one open incident. Dedup reduction is 1 − (incidents / active alerts) — exactly the workload cut a real SOAR gives a Tier-1 analyst by collapsing hundreds of raw detections into a handful of incidents to actually triage.

This 2D build reproduces the identical union-find scoring engine independently (same weights, threshold and time-decay math as the 3D original), rendered as a pannable/zoomable flat alert field plus a reduction-history strip instead of an orbiting 3D scene.

Feed: running

drag to pan · wheel/pinch to zoom