Cortex XDR employs sophisticated methods to correlate and group individual alerts into cohesive incidents. The primary mechanisms are the Causality Analysis Engine and the Analytics Engine. The Causality Engine stitches together event data using shared identifiers, such as process GUIDs (a form of session identifier), to build a cause-and-effect chain. Concurrently, the Analytics Engine uses machine learning to perform data stitching based on common entities like hosts, users, and IP addresses. This identifies relationships between alerts that may not be directly linked by causality but are part of a broader attack campaign, grouping them by shared attributes and similar tactics.
