From 40,000 Alerts to the Whole Attack Story: How SIEM+ Campaigns Connect Alerts, Cases and Attackers

Alert fatigue is not only a queue problem. It is a story problem.

When a SOC is flooded with notifications, analysts often open one case at a time. Each case may be correct on its own. What is missing is the wider picture: which cases belong to the same attacker activity, the same account, or the same technique path. That gap is why teams can reduce noise and still feel like they are chasing fragments.

We wrote earlier about how 40,000 alerts can become fewer than 10 cases a day, and why alert fatigue is a business problem, not only a SOC inconvenience. SIEM+ 1.1.0 adds the next layer: campaigns that connect related cases so you can move from a single alert to the whole attack story.

The problem: cases without the campaign

A typical day for a small or mid-size security team in Hong Kong, Singapore, Taiwan, Japan, or Indonesia looks familiar. The SIEM is doing its job. Alerts arrive. Cases get opened. Analysts work the queue.

What they often cannot see quickly is whether three cases on the same account are three unrelated issues—or one campaign that should be investigated together. Without that grouping, people spend time re-establishing context, miss shared infrastructure, and escalate the wrong slice of the story first.

SIEM campaign correlation is meant to fix that operational gap. It does not replace your SIEM. It organizes what your SIEM already produces so humans can decide faster.

What a campaign is in SIEM+

In SIEM+, a campaign is a rules-based group of related cases for one account.

Grouping follows explicit rules, including:

• MITRE ATT&CK technique
• data source
• day
• shared infrastructure

That is deliberate MITRE ATT&CK alert grouping—transparent, explainable, and consistent—rather than a black-box cluster that nobody can audit later.

Some activity stays in its own campaign on purpose. Privileged targets, rare techniques, and first-seen entities are kept separate so high-signal items are not buried inside a large, noisy group. Resolved or closed cases are never merged into an open campaign. Once work is finished, it stays finished.

Campaign → case → alert: the graph analysts use

Each campaign opens into an expandable tree:

1. Campaign at the top
2. Cases that belong to that campaign
3. Alerts behind each case (loaded on demand, so the tree stays usable)

From the same view, analysts also get links to related campaigns that share an entity. That is how you go from one noisy alert to a coherent story: open the case, see sibling cases in the campaign, expand the alerts that justify each case, then jump to related campaigns when the same user, host, or other entity appears elsewhere.

Illustrative example: an analyst opens a suspicious sign-in alert, finds it inside a case that sits under a campaign grouped by technique and day, expands the on-demand alert list for evidence, and follows a shared-entity link to another campaign that used the same infrastructure. The investigation path is the tree—not a pile of unrelated tickets.

The sample tree idea matches the campaign → case → alert illustration style used on siem.plus/features (sample data only).

AI proposes, analysts decide

This is the core differentiator versus black-box AI SIEM add-ons.

Grouping is code, not a model. Campaign membership is decided by rules. AI does not silently invent which cases belong together.

What AI does do:

• write titles and summaries
• suggest links between campaigns
• propose technique mappings

Every AI suggestion stays pending until an analyst accepts or rejects it. Technique mapping proposals also need analyst acceptance before they are used. AI alert triage here means assistance with language and suggestions—not unsupervised control of the investigation graph.

For SOC leads, that split matters. You get speed from automation and accountability from human decisions.

Cases opened for you: the case agent

Before campaigns can tell a story, related alerts still need to become cases.

The SIEM+ case agent groups related alerts into candidate cases and attaches an evidence table. Rules decide eligibility and perform every write. AI judges only ambiguous clusters and writes the case description. There is a daily cap on new cases per account, so automation cannot flood the queue it is supposed to tidy.

In practice, that means analysts start from candidate cases with evidence already laid out, then use campaigns to see how those cases fit a wider attack narrative.

Also new in SIEM+ 1.1.0

Campaigns are the headline, but 1.1.0 also adds:

• On-demand user hunt when you need to investigate a specific user without waiting for the next batch cycle
• Posture hunt findings with explanations, so findings are readable, not just scored
• Automatic catch-up of missed daily, weekly, and monthly reports, including campaign sections when those reports run late
• Faster dashboards and MITRE summaries, so ATT&CK-oriented review stays practical during busy shifts

Works on top of your SIEM

SIEM+ sits on the SIEM you already run. Officially supported today:

• Devo
• Microsoft Sentinel
• LogEase

Fortinet FortiManager support is coming soon. We do not claim other integrations here.

See current details on Integrations, feature walkthroughs on Features, and plans on Pricing. Platform Only starts at USD 300/mo.

What to do next

If your team still reviews alerts and cases as isolated tickets, try looking at the same queue as a campaign story: one account, related cases, expandable alerts, related-entity links, and AI suggestions that wait for a human yes or no.

That is SIEM+ 1.1.0 in practical terms—fewer fragments, more of the attack story, without replacing the SIEM you already trust.

FAQ

What is SIEM campaign correlation in SIEM+?

It is rules-based grouping of related cases for one account—using factors such as MITRE ATT&CK technique, data source, day, and shared infrastructure—so analysts can investigate a coherent campaign instead of disconnected cases.

Does AI automatically merge campaigns and cases?

No. Grouping is implemented in code. AI only writes titles and summaries and suggests links or technique mappings. Suggestions stay pending until an analyst accepts or rejects them.

Which SIEMs does SIEM+ 1.1.0 support?

Devo, Microsoft Sentinel, and LogEase are officially supported. Fortinet FortiManager is coming soon.

How much does Platform Only cost?

Platform Only starts at USD 300 per month. See siem.plus/pricing for plan details.