SIEM Correlation Engine: Sliding-Window Threshold Detection

Correlation Rule

alert if count(failed_login) ≥ 5 by src_host within 30s

Time window T 30s

Threshold N 5 events

Background noise 6 /min/host

Simulation speed 4×

Detection Stats

Alerts raised

True positives

False positives

Mean time to detect

—

Attacks launched

Attacks caught

How it works

A SIEM (Security Information & Event Management) does not "understand" an attack — it applies a correlation rule to a stream of log events. The classic building block is a sliding-window threshold rule: keep a per-entity queue of matching event timestamps, drop anything older than the window, and fire when the queue length reaches the threshold.

for each new event e at host h, time t:
  Q[h].push(t)
  while Q[h].front() < t - T: Q[h].pop_front()
  if len(Q[h]) ≥ N and not in_cooldown(h):
    raise_alert(h); cooldown(h, T)

Every host here streams ordinary background log noise (blue particles). A brute-force attack (red particles) is a burst of failed-login events far above the noise floor. The rule fires whenever N matching events land inside the last T seconds for the same host — visualised as a pulse racing from that host into the central engine.

Window T ↑ widens the net — more real attacks get caught, but coincidental noise clusters more easily too (↑ false positives).
Threshold N ↑ makes the rule stricter — fewer false positives, but a short/slow attack can now finish before the count is reached (↑ missed detections).
Background noise models routine failed logins from typos and expired passwords. A real SOC tunes T and N against this exact baseline, which is why every environment needs its own thresholds.
Mean time to detect (MTTD) is the real-world metric SOC teams optimise: how long from attack start to the alert firing, averaged over caught attacks.

This is the same primitive behind real correlation rules in Splunk ("N failed logins by src_ip in 5m"), Microsoft Sentinel scheduled analytics rules, and Elastic Security threshold rules — more advanced engines add sequence/order constraints and statistical baselining on top, but the sliding-window count is the foundation almost everything else builds on.

Benign log event Noise (matching type) Attack event

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.