Connect the signals.
Preserve the reasoning.
Events from cyber, physical security and OT only become useful together when their relationships can be explained.
ILLUSTRATIVE CORRELATION LOGIC · NOT A LIVE DETECTION RESULT
Three events. One context to investigate.
Three observations, one shared context. Follow the evidence that could connect them, without assuming a cause.
- 01
Access event
Door D-12 · access control
- 02
Camera unavailable
CAM-07 · physical security
- 03
Network anomaly
SW-08 · IT network
- 04
Same location
Production A
- 05
Temporal proximity
Within 12 seconds
- 06
Related assets
D-12 → AC-042 · CAM-07
- 07
Shared dependency
Network switch SW-08
HUMAN INVESTIGATION
Keep alternative explanations open.
Review the evidence before qualification or escalation. Time proximity and a shared dependency support a question, not a confirmed cause.
Check the sequence
Compare source timestamps, clock alignment and missing events. A replay timeline is not a measured network throughput.
Test other hypotheses
Maintenance, a local equipment fault or an incomplete source may explain the same observations. Verify the documented dependency on site.
Record the decision
Preserve the source evidence, rule, hypotheses and rationale. Traceable investigation is the workflow direction; it does not imply that every audit or collaboration function is available today.
ACTUAL PRODUCT CAPTURE · ATLAS SIMULATION · GROUPS TO REVIEW
Calculated groups to examine.
The Atlas replay contains fictional assets and events. Its calculated correlations are groups to review, not confirmed incidents.
SAFENETIS
Keep the evidence behind the decision.
SafeNetis does not currently claim automated active response.