net-incident-correlation

Incident correlation matches incident timing against network telemetry to reveal evidence for root-cause analysis. It analyzes syslog-style events and configuration changes within a defined time window to guide remediation.

Network incident correlation supports scope-aware analysis using site, AP, and client selectors. This focuses the investigation on specific devices or locations within the defined incident window.

Correlating incidents with network events requires configured event and change data sources, specifically syslog-style logs. The skill uses these inputs alongside the NETTOOLS helper and Python 3 to output a structured SkillResult.

Incident correlation analyzes configuration changes occurring within the defined incident window alongside syslog events. This evidence-driven approach produces ranked findings to accelerate incident response.

Network incident correlation requires the nettools-core dependency to function. The skill uses this NETTOOLS helper alongside Python 3 to process telemetry and output structured correlation results.

Correlating incident timing with network telemetry is the best way to find evidence of changes during a security incident. The skill ranks correlated syslog events and configuration changes to reveal actionable findings.