> For the complete documentation index, see [llms.txt](https://docs.cortex.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cortex.aic.io/workflow-guides/assurance/incident-correlation.md).

# Incident Correlation

**Open this area:** In the CORTEX menu, select **Assurance & governance → Security incidents**.

Link exact existing domain, access, policy and release events while preserving current source access.

**Who uses this:** Reviewer, Administrator\
**Open in CORTEX:** `/security/incidents`\
**In-app guide:** `/help?topic=incident-correlation`

**Expected result:** An authorised reviewer can follow retained incident relevance to exact source audit revisions.

## Before you start

* Select the incident's workspace and obtain Security read/manage plus the normal source permissions and complete handling.
* Pulse must be enabled with Pulse read and ordinary domain access for its ten business sources.
* Obtain an approved UK profile and explain the actual relevance and limits of the proposed relationship.

## What to do

{% stepper %}
{% step %}

### Start from an authorised audit

Use Correlate with an incident on a Pulse audit event, access grant, workspace, UK profile, incident, reporting rule or organisation operating policy.

No source permission is granted by this link.
{% endstep %}

{% step %}

### Inspect the exact event

Review the source action, actor, UTC time, revision and fingerprint.

Open the original record for its complete reason and payload.

The latest 64 events are offered; enter an exact older audit revision when needed.

Derived deadlines are not retained audit events.
{% endstep %}

{% step %}

### Choose the incident and explain relevance

Find the incident by title, inspect it, adopt the applicable approved profile and enter actual relevance and limitations.

Its handling must cover the selected event.

Save the link to retain exact incident, event and profile references.
{% endstep %}

{% step %}

### Follow the related records

From the incident detail open **Related audit records**.

Every source is checked again before any links, counts or rationale are shown.

Titles and links are current authorised source views; sensitive source payloads are not copied.
{% endstep %}

{% step %}

### Recover deliberately

Refresh source and selected incident after a conflict and compare the exact evidence.

Notes remain.

Retry an uncertain response with unchanged values on the same page.

If any source becomes unavailable, the whole relationship view closes without partial counts or text; request source/access review.
{% endstep %}
{% endstepper %}

## Check the result

* Is this an actual retained event?
* Does the incident cover its full handling?
* Are relevance and uncertainty explicit?
* Does the exact fingerprint still match?
* Can the reviewer still read every source?

## If you get stuck

<details>

<summary>Why did all links disappear after access changed?</summary>

A partial view could expose restricted relationships through counts or text. The service returns a neutral failure until current access to every referenced source is available.

</details>

<details>

<summary>Does a linked event prove a cause?</summary>

No. The recorded rationale expresses reviewed relevance and limits; source facts and incident assessment remain separate.

</details>

<details>

<summary>Are full audit payloads copied into another log?</summary>

No. Minimal source identity, actor/time/action and a digest are retained. Read the source through its normal permissions.

</details>

## Responsibility and limits

{% hint style="warning" %}
Security management is required to link; read permission alone grants no write or source access.
{% endhint %}

* Each incident retains up to 32 immutable links. Duplicate events and capacity overflow are rejected without pruning history. Correct mistaken inferences in the incident assessment.
* Original source bytes, enum values and hashes remain unchanged. Local fingerprints do not establish independent external custody.

**Reference and scope:** F23-R01. Correlation records reviewed relevance; it does not establish causation or investigative authority.

## Related workflows

* [Record and manage a defensive security incident](broken://pages/686a1f32f9bd42ca2b59d170632ad3d57be6a73e)
* [Track incident reporting and corrective actions](broken://pages/ca09bc7434b5a64dc02686b95d9cfc9a5e799e01)
* [Queue and verify independent audit custody](broken://pages/7857557ca44608c7dc9555a2bc078359aad7e3b5)
* [Use Pulse and inspect retained activity](broken://pages/3e675dcabccdf7035af677b0ea4672a994b1e962)
* [Manage accounts, grants and workspace membership](broken://pages/99c8701bc497eefb32769b668198b1f9f5fc6a93)
* [Preserve an exact revision and manage holds](broken://pages/0185ca5a2331760fb4c59665b8dde7f4d80e0fc6)