# Correlation in Elastic-SIEM

**URL:** <https://discuss.elastic.co/t/correlation-in-elastic-siem/235075>\
**Category:** SIEM\
**Created:** [May 31, 2020, 3:58pm UTC](https://discuss.elastic.co/t/correlation-in-elastic-siem/235075 "2020-05-31T15:58:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![arunpmohan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arunpmohan/32/69467_2.png) [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\
**Post date:** [May 31, 2020, 3:58pm UTC](https://discuss.elastic.co/t/correlation-in-elastic-siem/235075/1 "2020-05-31T15:58:30Z")

</div>

How well we can have a correlation using the Elastic-SIEM application?  
A sample use case would be  
I want to know, in the last 15minutes, for the events tagged that were tagged as "attack", whether the source IPs are equal to the destination IPs.

Also,I would like to know,if this is not possible in the current Elastic-SIEM, what would be a good approach to get near good results for this scenario?.

---

<div class="post-metadata">

**Author:** ![Mike\_Paquette](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mike_paquette/32/119011_2.png) [@Mike\_Paquette](https://discuss.elastic.co/u/Mike_Paquette)\
**Post date:** [June 4, 2020, 1:54pm UTC](https://discuss.elastic.co/t/correlation-in-elastic-siem/235075/2 "2020-06-04T13:54:27Z")

</div>

Hi @arunpmohan, thanks for the post.

The type of correlation-based detection you describe is not currently possible using the SIEM app detection rules. We are investigating methods for enabling these kinds of correlations in the future.

One idea in the interim is to use [Kibana scripted fields](https://www.elastic.co/guide/en/kibana/current/scripted-fields.html). These fields can be used in limited situations, such as Kibana visualizations and Kibana Discover. For example you could create a boolean scripted field such as "source\_equals\_destination" and then use a query such as `my_tag:"attack" and source_equals_destination:true` to identify the relevant events.

Thanks again, and please continue to provide us with additional feedback.

-Mike P.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 2, 2020, 1:54pm UTC](https://discuss.elastic.co/t/correlation-in-elastic-siem/235075/3 "2020-07-02T13:54:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.