Alert correlation and incident merging in the Microsoft Defender portal

Sysmon - Sysinternals | Microsoft Learn

Includes a session GUID in each event to allow correlation of events on same logon session. Logs loading of drivers or DLLs with their ...