Cross-domain correlation improves detection accuracy by testing a suspicious event against evidence from other domains before it becomes an alert. A single log line is ambiguous. The same event joined to the identity that caused it, the process that spawned it and the network flow that followed it is either clearly benign or clearly an attack. Fewer guesses, fewer false positives.
That is the short answer. The rest of this article explains the mechanism we call the AI triangle, shows what cross-domain pattern correlation looks like on a real lateral movement chain, sets single-source detection against correlated detection side by side, and gives you a way to evaluate any platform that claims to do this.
How does cross-domain correlation improve detection accuracy?
Detection accuracy has two failure modes, and they pull against each other. Loosen a rule and you catch more real attacks but bury the analyst in noise. Tighten it and the queue gets quiet while a real intrusion walks past under the threshold. Every SOC that has tuned a SIEM knows this trade. Single-source detection cannot escape it, because the only lever available is the threshold.
Correlation adds a second lever: corroboration. Instead of asking "is this event bad enough to alert on", the system asks "what else happened around this event, and does the combination make sense". A PowerShell process spawning from a document is common. A PowerShell process spawning from a document, on a host that authenticated from a new country twenty minutes earlier, then opening an outbound connection to a domain first seen yesterday, is not common at all. None of those three signals would survive a sensible threshold on its own. Together they are a case.
The accuracy gain comes from conditional probability, not from a better model. Each domain you add multiplies the number of coincidences an attacker must produce to look normal, while leaving genuine business activity untouched. Benign work rarely lights up endpoint, identity and network at the same time in the same pattern. Attacks routinely do, because an attacker has to move to make progress.
This is the same reasoning behind behaviour analytics, extended past the user. UEBA baselines a person. Cross-domain correlation baselines the relationship between a person, a device, a process and a destination, then judges the chain rather than the link.
The AI triangle: three methods that check each other
The AI triangle is SenseOn's name for the second half of the mechanism. Correlation decides what evidence belongs together. The AI triangle decides whether that evidence means anything, by testing it three independent ways.
Supervised learning
Supervised models learn from labelled examples of known attack behaviour. They are strongest on techniques that have been seen and documented: credential dumping tools, known loader families, well-mapped MITRE ATT&CK procedures. Their weakness is definitional. A supervised model can only recognise a shape someone has already drawn for it.
Unsupervised learning
Unsupervised models learn the environment rather than the threat. They build a picture of what normal looks like for each host, account and service, then measure distance from it. This is what catches the technique nobody has labelled yet, including insider misuse and living-off-the-land activity that uses only signed, legitimate binaries. Their weakness is the mirror image: an anomaly is not automatically malicious, and a busy enterprise generates unusual-but-fine behaviour constantly.
Deep learning over sequences
The third method works on order and timing rather than individual events. It reads sequences: this authentication, then that process, then that share enumeration, then that transfer. Multi-stage intrusions are defined by their order. An adversary who keeps every individual action below the threshold still has to perform the actions in a sequence that achieves something, and the sequence is the signature.
Each method has a blind spot the other two cover. When all three agree on a correlated chain of evidence, confidence is high and the case escalates. When one flags and the other two disagree, that is usually noise, and it is held for pattern analysis rather than pushed at a human. The triangle is not three models voting for the sake of it. It is three different kinds of wrongness cancelling out.
Cross-domain pattern correlation on a lateral movement chain
Lateral movement is where the difference is easiest to see, because lateral movement is by definition a cross-domain act. The attacker holds a credential in the identity domain, uses it over a protocol in the network domain, and lands as a process in the endpoint domain.
Watch it one domain at a time and each step looks defensible. A successful authentication from a valid account is not an alert. An SMB session between two internal hosts is not an alert. A service creation on a server is an administrative action that happens legitimately every day. Three domains, three tools, three quiet queues, and an attacker moving through the middle of them.
Watch the same chain correlated and the picture inverts. The account that authenticated has never touched that host before. The host it came from is a workstation, not a jump box. The service created on the destination runs a binary written to disk ninety seconds earlier by the same session. Nothing here needs a threshold argument. The chain is either a documented change or an intrusion, and the evidence to tell them apart is already assembled.
That assembly is the second benefit, and analysts feel it more than they feel the accuracy number. A correlated case arrives with the account, the source host, the destination, the process tree, the file write and the flows already joined. The investigation that used to mean four consoles and an hour of pivoting is now a read. This is the practical route out of alert fatigue: not fewer alerts through blunter rules, but fewer alerts because more of them are real.
Single-source detection versus cross-domain correlation
| Single-source detection | Cross-domain correlation | |
|---|---|---|
| False-positive behaviour | Ambiguity is unresolvable in-domain, so the threshold sets the noise level. Lowering it to catch subtle attacks floods the queue. | Ambiguity is resolved by corroboration from other domains, so sensitivity can stay high without the queue growing. |
| Coverage of lateral movement | Weak. The chain is split across identity, network and endpoint, and each step looks legitimate in isolation. | Strong. Lateral movement is a cross-domain act, so joining the domains reconstructs it as one chain. |
| Evidence available to the analyst | One domain's view. The analyst pivots manually across consoles to build the rest of the story. | The account, host, process tree, file activity and network flows arrive already joined, with the reasoning recorded. |
| Tuning burden | Continuous. Every environment change means re-tuning thresholds and writing exceptions to hold the noise down. | Lower and different. Behavioural baselines re-learn as the environment changes, and the work shifts to policy rather than thresholds. |
The table is not an argument that rules are obsolete. Signature and rule-based detection is precise, cheap and auditable for the things it covers, and it belongs in the stack. The point is that it is a poor instrument for behaviour that is only suspicious in combination, and most modern intrusion is exactly that.
SenseOn EDR false positives: what our own numbers show
Two published SenseOn numbers are relevant here, and they measure different things. Keep them apart.
The endpoint false-positive number is the independent one. In AV-Comparatives testing, SenseOn recorded 99% protection with zero false positives, which we set out in full in our write-up of the results. That is a detection-and-false-positive result for the endpoint agent, measured by a third-party lab. A lab result is a controlled measurement rather than a promise about your estate, and it should be read as one, but it does test the property that matters here: whether high sensitivity forces you to accept noise.
The second number is platform-level triage, not an EDR false-positive rate. Across all customer environments over a rolling 12-month window, SenseOn investigated 30M+ cases at a 0.68% true-positive density. Read that as a statement about the problem rather than a boast about the product: 99.32% of everything that looked worth investigating was correctly identified as not a threat. That is the signal-to-noise reality any detection platform sits inside, and it is why a system that merely scores events at scale hands its analysts an unwinnable queue. The full sample definition sits on our proof points page.
If you are comparing endpoint tools on this axis, our guide to EDR platforms sets out how the category differs on telemetry, response and evidence. The broader question of what AI does and does not do in detection is covered in AI in threat detection.
How to evaluate platforms for cross-domain threat correlation
Vendors describe correlation in nearly identical language, so ask questions that only a real implementation can answer.
Ask which domains are joined at analysis time, not at search time. Many platforms can join endpoint, identity, network and cloud data once an analyst writes the query. Far fewer perform the join before the alert is raised, which is the only version that changes what lands in the queue. Ask to see a case that was created because of a cross-domain relationship, not one where the relationship was added afterwards.
Ask what happens when one method disagrees with the other two. A platform that raises a case on any single signal has not built a triangle, it has built three sources feeding one queue. Ask how a disputed detection is handled and where it goes.
Ask to see the reasoning, not the score. A confidence number is not evidence. You should be able to open any decision and see which signals contributed, which domain each came from, what the model concluded and what a human changed. SenseOn records this as a Decision Trace on every case. Without that record you cannot audit a detection, and under FCA, NIS2 and DORA expectations you increasingly need to.
Ask what the tuning burden looks like in month three. Correlation reduces the threshold-tuning treadmill but does not remove operational work. Get a straight answer about what your team maintains: exception policies, business context, asset criticality, response boundaries.
Test it on your own lateral movement. Run an authorised exercise that crosses domains, and see whether the platform produces one case or three unrelated alerts. That single test tells you more than any feature matrix. You can see how this works on our platform overview or book a walkthrough and bring your own scenario.
Frequently asked questions
How does cross-domain correlation improve detection accuracy?
It resolves ambiguity with corroboration instead of thresholds. A single event from one domain rarely proves anything, so a rule must either alert on it or ignore it. Joining that event to the identity, process and network activity around it usually makes the answer obvious, which lets a platform stay sensitive to subtle attacks without flooding the analyst queue.
What is SenseOn's AI triangle?
The AI triangle is SenseOn's use of three independent analysis methods on the same correlated evidence: supervised learning for known attack patterns, unsupervised learning for deviations from an environment's own baseline, and deep learning over event sequences for multi-stage behaviour. Each covers the others' blind spots, and agreement between them is what drives a case to escalation.
How does multi-signal correlation improve behavioural detection accuracy?
Behavioural detection asks whether an action is unusual, which produces a lot of unusual-but-legitimate hits. Multi-signal correlation asks whether a pattern of actions across domains is coherent. Legitimate work rarely produces an unusual endpoint, identity and network pattern simultaneously, so requiring corroboration across signals cuts false positives while keeping sensitivity to genuine anomalies high.
Does cross-domain correlation reduce false positives in practice?
It reduces the number of ambiguous items that reach a human, which is the practical measure. Across SenseOn customer environments over a rolling 12-month window, 0.68% true-positive density across 30M+ cases shows how few investigated cases are genuine threats. Correlation is how a platform reaches that judgement in software rather than passing the ambiguity to an analyst.
Which data domains matter most for correlation?
Endpoint, identity and network are the minimum, because almost every intrusion touches all three: code runs somewhere, a credential is used, and something moves over a link. Cloud and email add the initial-access and data-movement paths that increasingly sit outside the traditional perimeter. Coverage matters more than depth in any one domain here.
How is this different from a SIEM correlation rule?
A SIEM correlation rule is a hypothesis someone wrote down in advance, and it fires when its conditions match. That works well for patterns you have already anticipated. Cross-domain correlation with behavioural models builds the relationships from the data itself, so it can surface chains nobody wrote a rule for, and it re-learns as the environment changes.
