Individual alerts may not provide a clear overall picture of changes across networks, authentication systems and applications. BASTION links multiple observations to help operators identify situations that need review.

This article explains the design approach to multi-layer correlation campaign detection and the points that need to be checked during operation.

1. Understanding the situation behind individual alerts #

When one device raises an alert, checking what other observations show can provide more context. This helps assess whether multiple alerts relate to connected activity or to independent events.

BASTION links observations and handles records used to review detection results and the evidence behind them. Observing an apparent relationship and concluding that an attack has occurred are evaluated separately.

2. Making the basis for decisions reviewable #

To use correlation results in operations, it is important to be able to review which observations led to a result. Observed facts, interpretations and actions actually taken are treated separately.

When information needed for a decision is missing, that gap must also be identifiable. An absence of detections and an absence of sufficient information do not mean the same thing.

3. Considering detection results alongside operational conditions #

When detection results are used for defense, the effects on legitimate users and business operations also need to be checked. BASTION handles responses within a defined scope and subject to protective conditions.

The available observation coverage, permitted actions and integration with existing operations are defined according to each deployment’s requirements. Clear responsibilities from detection through response support review and adjustment during operation.

4. Assessing detection counts and effectiveness separately #

We review detection results and response records in our own environment. However, an increase in detections alone does not demonstrate stronger protection or a low false-positive rate.

Missed anomalies and impacts on legitimate use need to be assessed separately. Scope and accuracy are evaluated according to the environment and observation conditions. This does not guarantee comprehensive detection, including unknown attacks, or the absence of erroneous blocking.

5. What to check before deployment #

Deployment begins with identifying the available observations and business constraints. Consider whether the necessary information can be obtained consistently, how detection results will be reviewed, and which users may be affected by a response.

The service overview page describes BASTION’s current capabilities and verification status. Deployment and evaluation scopes are quoted individually based on the target environment and requirements.

6. Scope of this explanation #

This article explains design principles that can be shared publicly. It does not disclose detailed evaluation formulas, internal settings or information about individual environments.