Cross-Telemetry Correlation of Endpoint and Network Security Alerts

This detection brief details a higher-order correlation rule designed for the Elastic Security platform to identify system compromises by analyzing telemetry across heterogeneous security sources. The rule monitors for concurrent suspicious activity reported by both host-based endpoint protection (Elastic Defend) and perimeter or network-level security controls, including Palo Alto Networks PAN-OS, Fortinet FortiGate, and Suricata.

By requiring that a host triggers distinct alerts across at least two separate security modules, the logic significantly reduces the noise associated with isolated alerts. The rule utilizes ESQL to normalize IP-based telemetry across these disparate data sources, focusing on high-risk indicators such as command and control (C2) communication, malware detection, unauthorized remote access, and exploit attempts. This approach is intended to pinpoint hosts exhibiting behavior characteristic of an active adversary, such as lateral movement or data staging, which often trigger alerts on both the compromised endpoint and the gateway monitoring its traffic.

Impact

Successful attacks identified by this correlation logic typically involve advanced persistent threats or automated malware campaigns that interact with external infrastructure. If left unmitigated, these incidents could lead to full system compromise, exfiltration of sensitive data, or the use of the host as a staging point for broader lateral movement within the network. This rule assists security operations centers (SOC) in prioritizing high-fidelity alerts where multiple security layers have independently flagged a specific asset as suspicious.

Recommendation

Prioritized actions for detection engineering and incident response:

• Deploy the ESQL correlation rule to your Elastic Security SIEM to unify alerts from Elastic Defend and existing network security appliances.
• Enable host IP collection for Elastic Defend (version 8.18+) to ensure the host.ip field is populated, as this is a prerequisite for the correlation logic.
• Tune the rule by identifying and excluding known benign noise sources, such as administrative scanning tools or legitimate internal vulnerability management scanners that may trigger overlapping network and endpoint alerts.
• Use the gathered context from the rule (including process command lines and destination IPs) to drive proactive threat hunting across the environment for related IOCs.