# IDR Investigation - Correlation

**URL:** <https://discuss.rapid7.com/t/idr-investigation-correlation/37245>\
**Category:** Automation\
**Tags:** InsightIDR\
**Created:** [May 14, 2024, 3:14pm UTC](https://discuss.rapid7.com/t/idr-investigation-correlation/37245 "2024-05-14T15:14:56Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmarohn](https://discuss.rapid7.com/letter_avatar_proxy/v4/letter/m/eada6e/32.png) [@mmarohn](https://discuss.rapid7.com/u/mmarohn)\
**Post date:** [May 14, 2024, 3:14pm UTC](https://discuss.rapid7.com/t/idr-investigation-correlation/37245/1 "2024-05-14T15:14:56Z")

</div>

I would like to see a way to correlate investigations based on IOCs including usernames and systems so that it is easier to identify issues and do more correlation for tuning purposes.

In the ideal world, I would like to see correlation on these fields:  
Username  
Hostname  
Source IP  
Destination IP  
File Hash  
File Name  
Threat Group/Actor

This would make it easier for identifying trends and improving detections. It would also be helpful if an analyst can correct, add, and remove data that is used for correlation between investigations.