Every security team we've audited shares a version of the same problem. Alerts come in from multiple systems. Analysts open four screens. They manually look for connections. They build the picture by hand. Meanwhile, the incident is progressing.
The average MTTR in critical infrastructure is 42 minutes. In most of those incidents, the threat was visible in the data within the first 3 minutes. The other 39 minutes were spent connecting the dots.
D2R's Intelligence layer — built around a structure we call the KnowledgeGraph — eliminates that 39-minute gap.
What the KnowledgeGraph Is
The KnowledgeGraph is a real-time, continuously updated graph database that maps every entity in your security environment and the relationships between them. Entities include: people, assets, locations, events, and systems.
A person (David, badge ID 4421) has relationships to: the locations they've accessed today, their usual access patterns, their assigned devices on the IT network, and their proximity to OT assets at any given time. When an anomaly touches any of these relationships, the KnowledgeGraph can surface the connected context in milliseconds.
Cross-Domain Correlation in Practice
This is what a KnowledgeGraph correlation looks like on a real event type — the classic "terminated badge with active network session" scenario:
- 14:32:07 — PACS: Badge 4421 scans into Server Room 3. Normal access time.
- 14:33:44 — IT/SIEM: Device associated with badge 4421 initiates unusual outbound connection to external IP.
- 14:34:01 — HR feed: Employee status updated to "Terminated" (backdated to 14:00).
- 14:34:03 — D2R KnowledgeGraph: Flags cross-domain anomaly. Badge is active post-termination. Network activity is concurrent with physical access. Forwards to Decision layer with confidence score 0.94.
In a siloed environment, this scenario requires an analyst to simultaneously monitor the PACS dashboard, the SIEM, and the HR system — and to manually connect events that happened 90 seconds apart across three different platforms. The KnowledgeGraph does this automatically, in under 2 seconds.
Confidence Scoring
Not all correlations are equal. The Intelligence layer assigns a confidence score (0.0–1.0) to every correlated event set based on: the number of independent signals supporting the correlation, the strength of the relationship between the entities involved, the recency and consistency of the anomaly, and the historical false-positive rate for this event pattern in this environment.
Events above 0.85 confidence route directly to Decision-layer automation. Events between 0.60–0.85 route to an analyst queue with the full context pre-assembled. Events below 0.60 are logged and monitored for pattern development.
This tiering is why D2R clients see a 93% reduction in manual analyst correlation work — the vast majority of true positives are above 0.85, and the KnowledgeGraph has assembled the evidence before the analyst opens the ticket.
OT-Specific Intelligence
OT environments present a specific challenge for correlation: most anomalies look normal. A Modbus write command to a PLC is standard operation — unless it's happening outside maintenance windows, from an unexpected source IP, immediately after a suspicious badge access to the control room. The KnowledgeGraph tracks temporal and relational context that single-system tools miss entirely.