Pivoting Across Endpoint, Identity and Network

What is it?

A pivot is following one shared entity — a host, an account, an IP, a hash — from the source that first showed it into every other source that mentions it. Correlation is a chain of pivots that assembles scattered records into one entity's story.

Why it matters

No single source sees a whole intrusion. Identity sees the sign-in, the endpoint sees the process, the network sees the callout. Only pivoting on the shared entity between them reveals that they are the same event seen from three angles.

Where you see it

In the SIEM, joining indexes on a normalised field (user, host, src_ip), and in the analyst's timeline where each row names its source. The pivot key is a value both sources record the same way.

What normal looks like

A benign entity appears in several sources but the mentions do not form a causal chain: a user signs in, prints, and browses — three sources, one account, no attacker story linking them.

What suspicious looks like

The same entity appears across sources in an order that reads as attacker behaviour: an anomalous sign-in, then a suspicious process on the host it reached, then an outbound connection from that process — each pivot explaining the next.

How analysts investigate

Choose a pivot key present in more than one source (usually host or account). Pull every source on that key in the window. Normalise the field names, lay the rows on one timeline, and read whether the cross-source order tells a coherent story.

Common beginner mistakes

Pivoting on a value that two sources record differently (short vs FQDN hostname) and concluding they do not match.
Following an entity into one extra source, seeing nothing, and stopping — instead of checking every source that could hold the next step.

One entity, three angles

   IDENTITY           ENDPOINT              NETWORK
   sign-in j.rai ──▶  WS-19: winword ──▶   proxy: WS-19 ──▶ 203.0.113.44
   from new ASN       spawns powershell     POST 4GB
        │ pivot: account j.rai   │ pivot: host WS-19   │ pivot: src WS-19
        └──────────────┴──────────────────┴──────────────────┘
        one entity chain read across three independent sources

Each pivot key (account, then host) carries the story from one source into the next.

Worked example. Identity shows j.rai signing in from a new ASN at 02:14. Pivot on the account: which host did that session reach? Endpoint telemetry on WS-19 shows winword.exe spawning powershell.exe at 02:20. Pivot on the host: what did WS-19 do on the network? The proxy shows a 4 GB POST from WS-19 at 02:53. Three sources, two pivots (account → host), one coherent chain. The benign version breaks the chain: the sign-in is j.rai's normal location, or the PowerShell has a signed parent, or the upload is a scheduled backup.

Quick check

You pivot from an identity sign-in to endpoint logs on the target host and see nothing suspicious. What is the correct next move?

A quick self-check — it doesn't affect your XP or progress.