What is the extent of event inspection and pre-processing to ensure near-real-time analysis and post-correlation analysis?

Upon the completion of log data collection, all applicable log data is immediately parsed/normalized within the data grid. As log messages are parsed, the analytics system correlates the applicable normalized data based on a set of correlation rules that can be defined by the user. Correlation across multiple platforms can be created via correlation policies in the Alert Logic® console. Upon the execution of an alert policy, Alert Logic log management will create a meta-event and insert it into the log record, send a proactive email alert notification (if desired), and create an incident case (if desired). The meta-event record can be used as an additional trigger for a secondary correlation policy (nested correlation rules).chris