Indicator correlation is the practice of matching clues from different systems to determine whether they describe the same security event. Those clues can include hashes, IP addresses, filenames, login times, alert IDs, registry changes, or network paths. A single indicator may be misleading on its own, but several indicators that align across logs and tools can build a stronger case.
This matters in cyber security because attackers often leave partial and noisy evidence. Defenders use correlation to tell the difference between a real intrusion, a false positive, and an unrelated incident. In ransomware investigations, for example, a posted hash, endpoint telemetry, and firewall logs may be compared to confirm whether a claim matches internal activity. Good correlation speeds triage, improves attribution confidence, and helps scope affected systems before response actions begin.