A sequence is a correlation pattern that triggers only when events occur in a specific order, often within defined time windows. It is used for attack paths where progression matters, such as initial compromise followed by privilege escalation. Sequences help analysts detect staged activity rather than isolated suspicious events.
How a Sequence Works in Detection
A sequence is a correlation rule that only fires when events happen in a specific order. That ordering turns a set of otherwise ordinary signals into a stronger analytic pattern, because the sequence represents progression rather than coincidence. Analysts use this to recognise stage-by-stage activity such as reconnaissance, access, and follow-on actions.
Sequences are especially useful when single events are too common to be meaningful on their own. The detection logic can require both order and, where needed, timing so that the alert reflects a realistic attack path instead of unrelated noise. That makes sequence-based detection more precise than broad event matching alone.
Why Order and Timing Matter
The key idea behind a sequence is dependency: the later event only matters because it follows an earlier one. In security monitoring, that dependency helps separate normal background activity from a chain of actions that suggests intent. A login failure followed by a successful login, or an initial foothold followed by privilege escalation, becomes more meaningful when analysed as an ordered set.
Time windows are often part of the design because the gap between events changes the interpretation. A sequence that occurs quickly may indicate an active intrusion, while the same events spread over a long period may be less actionable. The analyst’s goal is not just to see events, but to understand whether they fit a plausible progression.
Where Sequence Detection Fits in Security Operations
Sequence logic sits between raw event logging and full incident analysis. It helps security teams promote related events into a single narrative, which is important in environments with large event volumes and many low-signal alerts. This is one reason sequence detection is common in SIEM rules and threat-hunting workflows.
It is also valuable for identifying attack paths that unfold in stages. For example, a successful exploit followed by process creation and then credential access can be much more important than any one of those signals in isolation. In practice, sequence detection gives defenders a way to model attacker progression explicitly.
Common Uses and Limitations
Sequences work best when the order of activity is genuinely meaningful. They are less effective if the source events are incomplete, delayed, or inconsistently logged, because missing telemetry can break the chain and hide the pattern. They can also generate weak results if the rule is too broad, since ordinary user behaviour may accidentally resemble an attack path.
Good sequence design therefore depends on clear event selection, careful timing thresholds, and an understanding of what progression actually looks like in the environment. Used well, sequences improve detection fidelity; used poorly, they can create either blind spots or noisy alerts.
Risk and Threat Considerations
Attackers often operate in stages, so a sequence matters because it can reveal the path from initial compromise to deeper access. If defenders only look for isolated indicators, they may miss the combined meaning of events that become dangerous only when linked in order.
Failure mechanism: The rule may fail when telemetry is incomplete, event timestamps are unreliable, or the sequence window is poorly tuned, which can prevent the full chain from being recognised.
Impact: A missed sequence can delay detection of lateral movement, privilege escalation, or other follow-on activity, allowing an intrusion to progress further before responders see the pattern.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | Tactic/Technique Mapping — Adversary Tactics and Techniques | Sequences model ordered attacker progressions across ATT&CK stages. |
| Recommendation — Map ordered event chains to ATT&CK techniques and hunt for the next expected step. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor security systems and assets for anomalous activity | Sequence detection is a monitoring practice for spotting multi-step anomalies. |
| Recommendation — Tune detection logic to correlate related events into actionable anomalies. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Sequences depend on consistent log collection and event correlation for detection. |
| Recommendation — Centralise and retain logs so ordered activity can be correlated reliably. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Sequence rules operationalise analysis of audit records to identify suspicious chains. |
| Recommendation — Review audit records for ordered event patterns that indicate attack progression. | ||
Practitioner Guidance
What to watch for: Build sequence logic around actions that truly depend on one another, not around loosely related events that merely happen near each other. The best rules describe a realistic attacker progression and are supported by the logs you actually collect.
Practitioner takeaway: A useful sequence is one that adds context, not just correlation. If the ordered chain does not change your understanding of risk or response, it is probably too broad or too weak to be operationally valuable.
Related resources from NHI Mgmt Group
- What is the difference between traditional IAM risk scoring and sequence-based scoring?
- What is the difference between a suspicious login and an account takeover sequence?
- How should organisations sequence an IGA programme to reduce failure risk?
- How should security teams sequence cloud security controls for better identity governance?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org