# Correlate

> deterministic evidence-correlation engine

Correlate is a deterministic evidence-correlation engine for security
investigations. It normalizes heterogeneous SIEM observations into a canonical
form, then discovers typed relationships and activity chains between them. It
reports relationships and confidence, never conclusions or attribution. Every
response is reproducible byte-for-byte and carries a machine-readable receipt.

## Guarantees

- Deterministic: identical input + config produce an identical result hash.
- Explainable: every relationship lists the exact observations and factors behind it.
- Stateless: no database, no accounts, no background jobs. Input in, evidence out.
- Non-inferential: Correlate surfaces how observations relate; humans draw conclusions.

## API

- POST /api/v1/correlate - correlate events into relationships + chains + receipt
- POST /api/v1/normalize - normalize raw events into canonical observations
- POST /api/v1/explain - full provenance for one relationship or chain
- GET  /api/v1/rules - the correlation rule catalog
- GET  /api/v1/demo - correlation over the bundled reference incident
- GET  /api/health - liveness + readiness
- GET  /api/docs - OpenAPI 3.1 document

## Correlation rules

- process-lineage (v1) -> process_lineage: Relates process_create events where child.parent_process matches a parent process_name on the same host.
- actor-host-activity (v1) -> actor_host_activity: Relates consecutive endpoint actions by the same user on the same host into an activity timeline.
- authenticated-session (v1) -> authenticated_session: Relates a user_logon to its matching user_logoff for the same user and host pair.
- remote-authentication (v1) -> remote_authentication: Relates a network logon to the first endpoint activity by the same user on the destination host.
- host-network-flow (v1) -> egress_flow: Relates a source host to an external destination for outbound network connections.
- process-network (v1) -> process_egress: Relates a process launch to a following outbound external connection from the same host.
- c2-beacon (v1) -> c2_beacon: Groups repeated outbound connections from an internal host to one external IP as beaconing.
- credential-access (v1) -> credential_access: Relates sensitive process access (e.g. LSASS) to a following file write on the same host.
- lateral-movement (v1) -> lateral_movement: Relates internal host-to-host admin-port connections to subsequent execution on the destination host.
- service-execution (v1) -> service_execution: Relates a service creation to a child process spawned by that service on the same host.
- data-staging (v1) -> data_staging: Relates archive-tool execution to the archive artifact it stages on the same host.
- cloud-exfiltration (v1) -> cloud_exfiltration: Relates an external-bucket cloud upload to the staged archive it exfiltrates.
- indicator-removal (v1) -> indicator_removal: Relates deletion of a file/service to its earlier creation on the same host.

## Machine surfaces

- https://correlate.platphormnews.com/llms.txt
- https://correlate.platphormnews.com/api/docs
- https://correlate.platphormnews.com/sitemap.xml
- https://correlate.platphormnews.com/rss.xml