Patent attributes
According to examples, an apparatus may include a processor and a memory on which is stored machine-readable instructions that when executed by the processor, may cause the processor to identify a first set of entities corresponding to a security incident, identify anomalies associated with the first set of entities that occurred around a predefined time period with respect to the incident, identify a second set of entities associated with the identified anomalies, identify a set of incidents that share a common entity from the second set of entities, determine a probability of likelihood that the set of incidents normally share the common entity, determine whether the determined probability of likelihood falls below a predefined threshold, and based on the determined probability of likelihood falling below the predefined threshold, output an indication that the security incident and the set of incidents are likely related.
