Feature
Incident Correlation
When the same attack hits multiple nodes, Flowtriq automatically groups related incidents together. See the full blast radius, respond once, and track the campaign as a single event.
How It Works
When a new incident is detected, Flowtriq checks if any other active incidents in your workspace share the same attack family and occurred within the last 5 minutes. If a match is found, both incidents are grouped into an incident group with a unified title showing all affected nodes.
Automatic Grouping
No manual tagging required. When a UDP flood hits Node A and the same attack type appears on Node B within 5 minutes, they are automatically linked into a multi-node group.
Unified Dashboard View
Incident groups appear above your incidents list with expandable member details. See all affected nodes, combined peak PPS, and group status at a glance.
Auto-Resolve
When all member incidents in a group are resolved, the group automatically closes. No manual cleanup required.
Cross-Reference
Each incident detail page shows a banner linking to its group and all sibling incidents. Jump between related attacks instantly.
Why It Matters
Multi-node attacks are increasingly common. Attackers target entire infrastructure, not just individual servers. Without correlation, your team investigates each incident separately, missing the bigger picture.
With incident correlation, you see the full campaign: which nodes were hit, in what order, and with what combined volume. This enables faster escalation decisions and more accurate impact assessment for post-incident reports.
Related Features
Multi-Channel Alerts
Correlated incidents fire alerts once per group, reducing noise during multi-node campaigns.
Automated Runbooks
Trigger multi-step playbooks based on correlated group severity and blast radius.
Real-Time Analytics
Aggregate traffic analytics across all nodes in a correlated group for unified impact assessment.