Campaign

Unlike individual incidents, a campaign represents a broader pattern of malicious activity spanning multiple alerts, users, or organizations. Identifying campaign-level patterns, such as shared attacker infrastructure, TTPs, or malware, allows SOC teams to understand the full scale of a threat and respond more effectively. Without campaign-level visibility, analysts risk investigating each related alert in isolation, duplicating effort and missing the bigger picture.