Fig. 1From: OMMA: open architecture for Operator-guided Monitoring of Multi-step AttacksExample of an event tree for classical correlation with three multi-step attacksBack to article page