Feature

Incident Correlation

When the same attack hits multiple nodes, Flowtriq automatically groups related incidents together. See the full blast radius, respond once, and track the campaign as a single event.

Auto

correlation engine

5 min

correlation window

Unified

group visibility

How It Works

When a new incident is detected, Flowtriq checks if any other active incidents in your workspace share the same attack family and occurred within the last 5 minutes. If a match is found, both incidents are grouped into an incident group with a unified title showing all affected nodes.

Automatic Grouping

No manual tagging required. When a UDP flood hits Node A and the same attack type appears on Node B within 5 minutes, they are automatically linked into a multi-node group.

Unified Dashboard View

Incident groups appear above your incidents list with expandable member details. See all affected nodes, combined peak PPS, and group status at a glance.

Auto-Resolve

When all member incidents in a group are resolved, the group automatically closes. No manual cleanup required.

Cross-Reference

Each incident detail page shows a banner linking to its group and all sibling incidents. Jump between related attacks instantly.

Correlation Flow

Attack Hits Node A

Incident created with attack family, source IPs, and timing data.

Engine Checks Window

Same family + overlapping source IPs + within 5 minutes = correlated.

Group Created

Both incidents linked. Alerts fire once for the group, not per-node.

Why It Matters

Multi-node attacks are increasingly common. Attackers target entire infrastructure, not just individual servers. Without correlation, your team investigates each incident separately, missing the bigger picture.

With incident correlation, you see the full campaign: which nodes were hit, in what order, and with what combined volume. This enables faster escalation decisions and more accurate impact assessment for post-incident reports.

Multi-Node Visibility

See every node affected by a coordinated attack in one view. Know instantly whether the attacker is targeting a single server or sweeping your entire fleet.

Alert Deduplication

Get one alert per attack campaign, not one per node. When 10 servers are hit simultaneously, your Slack channel sees one grouped notification with the full blast radius.

Combined Metrics

Aggregate peak PPS, total bandwidth, and source IP overlap across all group members. Understand the true scale of coordinated attacks.

Post-Incident Reports

Generate reports that capture the full multi-node campaign. Timeline, affected nodes, combined impact, shared source IPs, all in one document.

L7 Cross-Layer Correlation

When an L7 HTTP flood is detected from the access log, Flowtriq cross-references the attacking source IPs against recent L3/L4 incidents from the same workspace. If the same IPs appear in both network-layer and application-layer attacks, the incidents are linked for unified analysis.

This reveals multi-layer campaigns where attackers combine volumetric floods with targeted HTTP requests, giving you the complete attack picture across protocol layers.