SIEM correlation deduplicates brute-force alerts and hides the real spray scope

Analysts see only a few incidents, but the attack is much wider because the correlation rule collapses repeated signals into one coarse event group.