Classification of cyber-alerts into security incidents

An apparatus for protecting a computer network, comprising:

• a network interface card (NIC);
• and
• at least one processor configured:
• to receive alerts of multiple different types, indicative of potentially malicious activity in the network, that are detected by multiple different protection appliances deployed in the network,
• to correlate the alerts so as to identify a first alert of a first type from a first protection appliance in the network and a second alert of a second type, different from the first type from a second protection appliance in the network that are together indicative of a single attack on the network, and
• to issue a consolidated alert responsively to the attack.

A computer software product for protecting a computing system, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to receive alerts of multiple different types, indicative of potentially malicious activity in the network, that are detected by multiple different protection appliances deployed in the network;
• to correlate the alerts so as to identify a first alert of a first type from a first protection appliance in the network and a second alert of a second type, different from the first type from a second protection appliance in the network that are together indicative of a single attack on the network;
• and
• to issue a consolidated alert responsively to the attack.