Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

User Guide: AI Correlation Agent

Overview

A new AI Correlation Agent links incoming alerts to existing Physical Security Incidents (PSIs) and adds the alert’s description to the matched PSI. If the agent cannot find a correlated PSI, it creates a new PSI automatically and attaches it to the alert. The correlation flow works together with the existing AI Categorization Agent, which categorizes the PSI based on its description, payload, and other details once a link is established.

What's New

  • Automatic correlation — when an alert is saved, the agent automatically searches existing PSIs for a match and links the alert to the best candidate.
  • Automatic PSI creation — if no correlated PSI is found, the agent creates a new PSI from the alert details and links it, so no alert is left unassigned.
  • Confidence scoring with reasoning — the agent posts work notes on the record showing the correlation certainty (as a percentage), the action taken, and the reasoning behind the match. A 100% match is not required — the agent uses context (wording, location, and details) to judge relevance.
  • Chained categorization — once a correlation (or new PSI creation) completes, the existing AI Categorization Agent runs automatically, categorizing the PSI and posting its own confidence and reasoning to the work notes.
  • Configurable flow (planned) — system properties will be added to the workspace so the correlation-to-categorization flow can be adjusted per client. For example, a client that doesn’t need automatic categorization after linking will be able to disable that step.

            How It Works

            1. An alert is created with a short description and description of the event.
            2. Saving the alert automatically triggers the AI Correlation Agent.
            3. The agent searches existing Physical Security Incidents for a contextual match and adds work notes with the correlation certainty, the action taken, and its reasoning.
            4. If a matching PSI is found, the alert is linked to it and the alert’s summary is added to the PSI.
            5. If no matching PSI is found, a new PSI is created from the alert and linked to it.
            6. The AI Categorization Agent then runs automatically on the PSI, setting category and subcategory and posting its own reasoning and confidence to the work notes.

                        Example Scenarios

                        Case 1: High-Confidence Correlation

                        An alert is created reporting "an armed intruder has entered the east wing corridor." The agent finds a high-confidence match to an existing critical PSI describing an active armed intruder in the east wing corridor, links the alert to it, and posts work notes explaining the match. The Categorization Agent then runs and updates the PSI’s category and subcategory.

                        Case 2: Lower-Confidence Correlation

                        An alert is created about a broken physical access badge needing immediate replacement, worded differently from the related existing PSI. The agent still recognizes the context, links the alert to the matching PSI, but reports a lower certainty percentage in the work notes. The Categorization Agent then runs and categorizes the PSI correctly.

                        Note: if the Categorization Agent does not appear to trigger right away, reloading the form usually resolves a temporary connection delay.

                        Case 3: No Match — New PSI Created

                        An alert is created reporting that the network team has detected a major ransomware attack on the facility network. No existing PSI matches this description, so the agent returns a certainty of 0% with the reasoning "no active physical incident candidate aligned with that description," and creates a new PSI from scratch, linking it to the alert. The Categorization Agent then categorizes the new PSI (for example, category "Intelligent," subcategory "Cyber") based on its content.

                        For Admins: Configuring the Flow

                        • The correlation-to-categorization flow can be adjusted to fit each client’s needs — for example, skipping the categorization step for clients who don’t require it once a PSI is linked.
                        • Upcoming system properties will make this flow configurable directly in the workspace, without requiring a custom change.
                        • Review the agents’ work notes periodically to confirm correlation and categorization confidence levels remain accurate as new PSI types are introduced.