Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Optimize case grouping in correlations

Optimize case grouping for correlation-based detections.

When custom detections (such as correlation rules) generate issues, those issues might not group automatically into related cases—even when they appear related from a user perspective.

Case grouping is determined by Cortex Cloud’s broader grouping and machine learning logic, which evaluates relationships, context, and shared artifacts across issues.

To optimize how Cortex Cloud groups issues triggered by correlations, you can map specific fields that influence grouping and prioritization.

Why field mapping matters in issue grouping

Cortex Cloud’s grouping and machine learning models use specific fields to construct grouping artifacts. These artifacts are then used to evaluate whether issues are related to each other or to an ongoing activity.

Not all fields influence grouping. To contribute effectively to grouping and prioritization, your correlation rules must supply one or more of the relevant fields in a supported format that Cortex Cloud can interpret. In addition, ensure that the mapped fields adhere to the correct field structure, and expected formatting requirements.

If these fields are missing, incorrectly mapped, or improperly formatted, Cortex Cloud may be unable to correlate related issues accurately. This can reduce grouping effectiveness and lead to unnecessary issue fragmentation across multiple cases.

Benefits of proper grouping configuration:

  • Correlate related custom issues into a single investigative workflow

  • Reduce issue and case fragmentation

  • Reduce over grouping of issues in cases

  • Improve investigation efficiency

  • Strengthen ML-based prioritization and correlation

  • Align custom detections with organizational context

Note

Field mapping does not guarantee grouping.

Cortex Cloud grouping uses machine learning and platform logic that evaluates confidence, context, relationships, and additional case signals. Field mapping helps influence grouping by contributing relevant artifacts, but final grouping decisions are determined by the platform’s overall grouping logic.

For more information about case grouping behavior, see Case grouping.

Configure field mapping to optimize grouping

To optimize grouping for issues generated by correlation rules, take the following steps:

  1. Create or edit a correlation rule: Define the logic that triggers the issue based on your specific security requirements. For full instructions on creating correlation rules, see Create a correlation rule.

  2. Map fields to influence grouping: Map your data to the fields for which you want to group (e.g., IP Artifact, Actor Artifact, User). The grouping engine uses these fields to identify commonalities across different issues.

For details of the specific fields that influence case grouping and their expected formatting requirements, see the table below.

Best practices

  • Use stable identifiers that are likely to remain consistent across related detections

  • Ensure field values match expected Cortex formats

  • Avoid overly broad mappings that may unintentionally group unrelated issues

  • Use the same mapping strategy across related custom rules when consistent grouping is desired

Field mapping reference for grouping artifacts

The following table presents the full set of fields that influence case grouping, their descriptions, and the expected formats.

Artifact type
Details

Actor Artifact

  • Field name: Initiator SHA256

  • Description (Purpose): The process hash is a SHA256 identifier of the initiator executable, independent of name or path.

  • Field type: SHA256

  • Format:

    • Valid: a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456 (64 hexadecimal characters)

    • Valid: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 (uppercase also valid)

    • Invalid: abc123 (must be exactly 64 characters)

    • Invalid: 0000000000000000000000000000000000000000000000000000000000000000 (empty hash, excluded)

Causality Artifact

  • Field name: CGO SHA256

  • Description (Purpose): The SHA256 hash value of the Causality actor process that initiated the issue.

  • Field type: SHA256

  • Format:

    • Valid: a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456 (64 hexadecimal characters)

    • Valid: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 (uppercase also valid)

    • Invalid: abc123 (must be exactly 64 characters)

    • Invalid: 0000000000000000000000000000000000000000000000000000000000000000 (empty hash, excluded)

Process Artifact

  • Field name: Target process SHA256

  • Description (Purpose): The SHA256 hash value of the target process affected by the action, such as the injectee in injection.

  • Field type: SHA256

  • Format:

    • Valid: a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456 (64 hexadecimal characters)

    • Valid: E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855 (uppercase also valid)

    • Invalid: abc123 (must be exactly 64 characters)

    • Invalid: 0000000000000000000000000000000000000000000000000000000000000000 (empty hash, excluded)

File Artifact

  • Field name: File SHA256

  • Description (Purpose): The file hash artifact represents the SHA256 cryptographic hash of a file involved in the issue. This could be a file that was created, modified, or accessed.

  • Field type: SHA256

  • Format:

    • Valid: d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2 (64 hex chars)

    • Invalid: abc (too short)

    • Invalid: not-a-hash (non-hexadecimal characters)

IP Artifact

  • Field name: Remote IP

  • Description (Purpose): This field represents the IP address associated with the network event. It typically refers to the remote/destination IP address that the endpoint communicated with.

  • Field type: IPv4 string (e.g., 192.168.1.1)

  • Format:

    • Valid: 192.168.1.25 (IPv4 address, values 0-255)

    • Valid: 8.8.8.8 (public IP)

    • Invalid: 192.168.300.25 (values must be between 0-255)

    • Invalid: 192.168.1 (incomplete address)

IPv6 Artifact

  • Field name: Remote IPv6

  • Description (Purpose): The IPv6 address artifact represents the 128-bit IP address in the newer Internet Protocol version 6 format. Like IPv4, it identifies network communication endpoints but uses a different addressing scheme.

  • Field type: IPv6 string (e.g., 2001:0db8::1)

  • Format:

    • Valid: 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full format)

    • Valid: 2001:db8:85a3::8a2e:370:7334 (compressed format)

    • Invalid: 2001:0db8:85a3:0000:0000:8a2e:0370:GGGG (invalid hex characters)

Domain Artifact

  • Field name: DNS Query Name

  • Description (Purpose): The domain artifact represents the fully qualified domain name (FQDN) or hostname that was accessed during the network event. This can come from DNS queries or HTTP/HTTPS requests.

  • Field type: DNS name string (e.g., example.com)

  • Format:

    • Valid: malicious-site.com (normalized to lowercase)

    • Valid: subdomain.example.org (subdomains included)

    • Invalid: 192.168.1.1 (IP addresses are not domains)

    • Invalid: example..com (double dots invalid)

Cmd Artifact

  • Field name:

    • Initiator CMD

    • Initiator Path

    • Initiated By

  • Description (Purpose): The command line artifact captures the full command line used to execute a process, including all arguments and parameters. This is normalized (lowercased, trimmed, spaces standardized) to ensure consistent matching.

  • Field type: Raw string

  • Format:

    • Initiator CMD: Minimum command line length of 5 without spaces and program image name.

      • Valid: powershell.exe -ExecutionPolicy Bypass -File “C:\ProgramData\setup.ps1”

    • Initiator Path: Not empty

      • Valid: C:\Windows\System32\powershell.exe

    • Initiator By: Not empty

      • Valid: powershell.exe

  • Notes:

    • All fields need to be mapped and non-empty.

HOST

  • Field name: Host Name

  • Description (Purpose): The hostname artifact identifies the computer or device where the event occurred. This can be a NetBIOS name, DNS hostname, or in some cases a local IP address (for firewall alerts without hostname). Hostnames are normalized and length-limited to ensure consistent matching.

  • Field type: String

  • Format:

    • Valid: DESKTOP-ABC123 (Windows hostname)

    • Valid: server01.corp.local (FQDN)

    • Valid: ubuntu-server (Linux hostname)

    • Invalid: host name with spaces (spaces not allowed)

AGENT_ID

  • Field name: Agent ID

  • Description (Purpose): The Agent ID is a unique identifier assigned to each endpoint agent installed in the environment. This ID persists across hostname changes and reinstalls, making it a reliable identifier for tracking a specific device.

  • Field type: String

  • Format:

    • Valid: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6 (alphanumeric string)

    • Valid: {12345678-90AB-CDEF-1234-567890ABCDEF} (GUID format)

    • Invalid: agent-123 (format depends on agent type)

USER

  • Field name: User name

  • Description (Purpose): The username artifact represents the user account that was active during the event. This is normalized to include both the username and domain (if applicable) in the format domain\username or username@domain. The system excludes common system accounts (SYSTEM, LOCAL SERVICE, etc.) and known service accounts to focus on actual user activity. Cloud identities have special handling for IAM users, service accounts, and federated identities.

  • Field type: String

  • Format:

    • Valid: DOMAIN\jsmith (Windows domain user)

    • Valid: jsmith@company.com (email format)

    • Valid: jsmith (local user)

    • Invalid: SYSTEM (excluded as common account)

    • Invalid: NT AUTHORITY\SYSTEM (excluded as system account)

URL

  • Field name: Url

  • Description (Purpose): The URL associated with the alert. It typically refers to a web address observed in the activity that triggered the alert — such as a URL accessed by a user, contained in an email, or referenced by a network request.

  • Field type: String

  • Format:

    • Valid: http://www.maliciousdomain.com/some-malware

    Notes:

    • Supported only in Platform.

External Grouping Artifact

  • Field name:

    • Case Grouping External Artifact Name

    • Case Grouping External Artifact Id

  • Description (Purpose): Groups issues into cases using external parent-object logic. It preserves grouping structure from third-party tools to ensure seamless alert consolidation in our system.

  • Field type: String

  • Format:

    • Case Grouping External Artifact Name:

      • Valid: Corp SIEM

    • Case Grouping External Artifact Id:

      • Valid: INC0012345

  • Notes:

    • Supported only in Platform.

    • Both fields need to be mapped and non-empty.

Examples

Example 1:

Group multiple suspicious login detections by user

The correlation rule detects:

  • Impossible travel login

  • Multiple failed logins

  • Privileged login from new location

Map:

  • User name → (e.g. jsmith@company.com)

Result: Issues that share the same user are more likely to group into a single case.

Example 2:

Group endpoint persistence detections by host

The correlation rule detects:

  • Registry persistence

  • Suspicious scheduled task

  • New service installation

Map:

  • Host Name → (e.g. DESKTOP-ABC123)

  • Agent ID → <Agent_ID>

Result: Issues on the same endpoint are more likely to group into a shared case for endpoint investigation.

Example 3:

Group phishing detections by sender domain

The correlation rule detects:

  • Suspicious attachment

  • Spoofed sender

  • Credential harvesting link

Map:

  • DNS Query Name → Domain (e.g malicious-site.com)

Result: Related phishing activity tied to the same domain may group more effectively.

PreviousView excepted issues
NextCreate a sync profile

Last updated

Was this helpful?