Latent-context alert correlation engine in a security management system

One or more computer-storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and memory, cause the processor to perform operations, the operations comprising:

• accessing first security data of a first alert and second security data of a second alert, wherein the first alert and the second alert are not connected based on the first alert and the second alert not having a common entity identified in a security graph;
• using the first security data, the second security data, and a latent-context alert correlation graph model, determining that the first alert is connected to the second alert based on a latent-context connection, wherein the latent-context connection is a derived attack-path-based connection that maps security data in a latent-context alert correlation graph associated with latent-context alert correlation graph model;
• and
• based on determining that the first alert is connected to the second alert, generating a security incident associated with the first alert and the second alert;
• and
• communicating a notification comprising the security incident.

A computer-implemented method, the method comprising:

• accessing first security data of a first alert and second security data of a second alert, wherein the first alert and the second alert are not connected based on the first alert and the second alert not having a common entity identified in a security graph, wherein the first alert and the second alert are associated with a computing environment;
• using the first security data, the second security data, and a latent-context alert correlation graph model, determining that the first alert is connected to the second alert based on a latent-context connection, wherein the latent-context connection is a derived attack-path-based connection that maps security data in a latent-context alert correlation graph;
• and
• based on determining that the first alert is connected to the second alert, generating a security incident associated with the first alert and the second alert.