Campaign Correlation Engine
Seven weighted detectors automatically link related attacks into unified campaigns — the work SOC analysts do manually, done in microseconds at the edge.
7 Correlation Detectors
Each detector runs independently, producing a weighted confidence score
Attack Sequence
Same attack payloads appearing across different source IPs.
CATCHES: Coordinated vulnerability scanning, distributed SQLi/XSS campaigns
Auth Token
Same JWT structure or issuer appearing across multiple IPs.
CATCHES: Credential stuffing, token replay, shared bot infrastructure
HTTP Fingerprint
Different IPs with identical browser fingerprints (JA4H).
CATCHES: IP-rotating bots, residential proxy attacks, same tooling
TLS Fingerprint
Same TLS signature (JA4) across different sessions.
CATCHES: Scanner frameworks, bot toolkits, headless browser farms
Behavioral Similarity
Identical navigation and timing patterns across actors.
CATCHES: Scripted attacks, automated reconnaissance, identical crawl paths
Timing Correlation
Coordinated request timing patterns across IPs.
CATCHES: Botnets, DDoS precursors, synchronized attack waves
15
Network Proximity
Same ASN or /24 subnet clustering. Lowest weight — supporting evidence, not primary signal.
CATCHES: Hosting provider abuse, VPS farm attacks, related infrastructure
Confirmed campaign — block all associated actors fleet-wide
High confidence — issue progressive challenges via Interrogator
Medium — apply rate limiting, continue monitoring signals
Low — log signals for investigation, no enforcement action
Signal Intelligence — 4 Categories
Auth Tokens
JWT structure
Device Fingerprints
Browser profile
Network Signals
IP + ASN
Behavioral Signals
Navigation paths
Fleet Mode — Cross-Sensor Correlation
Horizon
Correlates signals across all sensors
Cross-Sensor Campaigns
Attacks spanning multiple locations unified into single campaigns
Global Block Lists
Block propagated from one sensor to entire fleet instantly
Unified Actor Profiles
Single view of threat actors across your entire fleet
War Rooms
Real-time incident coordination with full campaign context