Correlate a New Alert Against Prior Incidents by Meaning

Objective

Exact-IOC matching (this hash, that IP) misses the adversary who changes one artifact but keeps the same technique. This recipe correlates a new alert against your threat-intel and past-incident corpus by meaning, so "PowerShell downloaded a payload and made a scheduled task" matches a prior report that describes the same TTP in different words.

Step 1: A threat-intel corpus with embeddings

DROP TABLE IF EXISTS threat_intel;

CREATE TABLE threat_intel (
    id    TEXT PRIMARY KEY,
    kind  TEXT,
    descr TEXT,
    emb   VECTOR(384)
);

INSERT INTO threat_intel VALUES
 ('TI-1','ttp',
  'Adversary used PowerShell to download a payload and establish persistence via a scheduled task.',
  EMBED('Adversary used PowerShell to download a payload and establish persistence via a scheduled task.'));

Step 2: Correlate a fresh alert

SELECT id,
       kind,
       COSINE_SIMILARITY(
         emb,
         EMBED('Suspicious powershell script fetched a remote binary and created a persistence scheduled job.')
       ) AS sim
FROM   threat_intel
ORDER  BY sim DESC
LIMIT  1;

Result — the paraphrased alert matches the prior TTP report:

Why it matters

The correlation is on behavior, not on a brittle exact indicator, so it survives the small changes attackers make between campaigns. Pair it with attack-path analysis for blast radius and a write-once audit for accountability. To resolve one actor across many artifacts, see entity resolution.