correlate_changes
Cross-reference alert spikes with audit logs to identify changes that likely triggered alert increases. Use configurable correlation windows to pinpoint root causes.
Instructions
Cross-reference alert spikes with audit/change logs. Identifies changes that may have triggered alert increases using configurable correlation windows.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hours_back | No | Hours to look back | |
| correlation_window_minutes | No | Minutes after a change to look for alert spikes |