VALIDATING CORRELATION BETWEEN CHAINS OF ALERTS USING CLOUD VIEW

Methods, systems, and apparatuses are provided for evaluating a chain of alerts. Historical alerts may be grouped together to form sets of alerts based on a predetermined relationship between the alerts. A score is determined for each set of alerts representing a statistical likelihood that one alert in the set is correlated to another alert in the set, generating a plurality of scores for the sets of alerts. The scores may be placed into a model containing a score for each set of alerts. After the model is formed, a received chain of alerts may be evaluated by examining whether the chain of alerts, or a sub-chain of alerts, corresponds to a score in the model through an iterative process. If the chain of alerts corresponds to a score in the model and meets a predetermined criteria, a system administrator can be alerted of the chain of alerts.