What is event correlation in a SIEM, and can you give an example of a correlation rule that would detect a potential security incident from events that individually seem harmless?

Sample answer preview

Event correlation is the process by which a SIEM analyzes events from multiple log sources and identifies relationships between them that could indicate a security threat.