Enterprise Security: what makes a correlation search a correlation search?

[danielbb]

I'm looking at a sample correlation search called Abnormally High Number of HTTP Method Events By Src -

| tstats `summariesonly` count as web_event_count from datamodel=Web.Web by Web.src, Web.http_method 
| `drop_dm_object_name("Web")` 
| xswhere web_event_count FROM count_by_http_method_by_src_1d in web by http_method is above high

What makes it a correlation search?

[lkutch_splunk · Accepted solution]

Hi,
According to the ES tutorial... it's not just a search, but a search that then does one of the following:
"A correlation search is a type of search that evaluates events from one or more data sources for defined patterns. When the search finds a pattern, it creates a notable event, adjusts a risk score, or performs an adaptive response action. A correlation search is a saved search with extended capabilities making it easier to create, edit, and use searches for security use cases."
https://docs.splunk.com/Documentation/ES/5.3.1/Tutorials/CorrelationSearch

So since it creates a notable event, it's a correlation search.

[danielbb]

Ok, makes sense.

This particular search has the following Adaptive Response Actions -

1) Risk Analysis
2) Notable