What Happened, How Did It Happen, Who Was Involved, What Are The Damages
Correlation is the process of connecting related events across different systems, users, and timelines to understand how an incident actually unfolded. Instead of viewing logs as isolated records, Remi analyzes them together to determine which events are related, who performed them, and how one action led to the next.
AI performs this correlation automatically by examining time proximity, shared attributes, user identities, system interactions, and behavioral patterns. When events share common characteristics—such as the same user account, device, IP address, or command sequence—the AI links them together into a single investigative timeline.
Seeing the Whole Incident Across Systems
Modern incidents rarely occur on a single system. Activity often moves across multiple devices, platforms, accounts, and services as attackers progress through an environment. Correlation allows Remi to connect these events together so investigators can see the entire landscape of the incident instead of isolated fragments of activity.
The AI analyzes logs and artifacts from different sources—such as workstations, servers, cloud platforms, email systems, authentication services, and network devices—and identifies shared characteristics that link those events together. These connections may include the same user account, IP address, device identifier, file hash, session token, or sequence of actions.
