Why the Correlation Window Is Five Minutes

Correlating signals from several sources means deciding how far apart two events can sit and still be treated as the same occurrence. The answer is not a platform setting. It follows from how long the thing being observed takes to happen.

‍

For an AI interaction the answer runs to tens of seconds rather than milliseconds, which rules out exact timestamp matching and rules out sub-second claims. Anyone describing sub-second correlation across independent sources is describing something narrower than it sounds.

‍

Why Can't You Join on Exact Timestamps?

‍

Three reasons, and only the first is specific to AI. The other two apply to any distributed observation and are worth stating because they set the floor.

‍

Clocks disagree. Hardware drifts with temperature and load, time synchronization narrows the variance without eliminating it, and operating systems handle it differently. Windows authentication tolerates up to five minutes of skew by default, which is a useful reference point, since a correlation window narrower than the tolerance the authentication layer itself permits is asserting more precision than the environment supports.

‍

Pipelines lag. A record is generated, written locally, batched, forwarded, queued and indexed, and each stage adds time that varies by source. Processing is also sequential, so an event on one system triggers an event on another only after the first completes and the second receives it.

‍

What Does That Mean for a Byte-Level Join?

‍

It does not work either, which is the other tempting shortcut. A browser observing a paste counts characters in the page. A network sensor counts bytes on the wire after compression and encryption. The two numbers describe the same content and will not match, so joining on size equality discards true pairs rather than finding them. Three questions any telemetry claim should survive covers the wider version of this problem.

‍

What Makes an AI Interaction Slower Than a Machine Event?

‍

A person is in the middle of it. The human presence is the difference from ordinary log correlation and it determines the floor for any window.

‍

Composing a prompt takes time. Somebody pastes content, reads it, edits it, adds an instruction and submits, and the interval between the paste landing in the page and the content leaving the network is routinely tens of seconds. A browser-level source records the paste at the moment it happens. A network sensor records the upload when it occurs. Both are correct and they describe events well apart in time.

‍

Tunnel Accounting Also Finishes Late

‍

A second AI-specific effect compounds it. Where traffic runs through an uninspected tunnel, byte counters are frequently finalized at teardown rather than during transfer, so the network's record of how much moved appears when the session closes. A window sized for the transfer misses a record that arrives when the connection does.

‍

Why Not Just Use a Wider Window?

‍

Because width buys recall and costs precision, and past a certain point it manufactures findings rather than surfacing them.

‍

A window of an hour will capture the true pair and also every unrelated event by the same person in that hour. In an environment where somebody touches AI tools repeatedly through a working day, a wide window produces plausible-looking joins between actions with no relationship, and a correlation that is wrong is worse than one that is absent because somebody will act on it.

‍

So the Window Is a Trade Rather Than a Setting

‍

Narrow enough to exclude unrelated activity, wide enough to absorb clock disagreement, pipeline lag and human composition time. For a single-user AI interaction that lands in the region of minutes, and the reasoning behind the number is what makes it defensible rather than the number itself.

‍

Should Every Scenario Use the Same Window?

‍

No, and using one global window is the most common methodological error. The window should match the natural duration of the mechanism being observed, which varies by orders of magnitude.

‍

A single paste into a browser session is a few seconds of activity across sources that mostly share a host. A tenant-wide permission grant being exercised by an automated process is a matter of hours between the consent and the first bulk read. A departing employee staging data across a working week is measured in days. Applying a five-minute window to the third finds nothing, and applying a multi-day window to the first finds everything.

‍

The Window Belongs to the Scenario

‍

Each detection carries its own, chosen from how the underlying activity behaves rather than inherited from a platform default. Recording that choice alongside the rule is what allows somebody to challenge it, and an AI Interaction Data Fabric holds the window per scenario for that reason.

‍

What Should You Ask About a Correlation Claim?

‍

Four questions, and the first two separate genuine cross-source correlation from a single sensor reporting several fields.

‍

• Which sources, independently: A product reading five fields from one agent is reporting, not correlating.
• What is the join key: Time alone is not a key. There has to be an identifier shared across the sources being joined.
• What is the window and why: A number with no reasoning behind it was chosen for convenience.

‍

The fourth is what happens when sources disagree. Two records that should match and do not are either a correlation failure or the finding itself, and a system that silently resolves the conflict has discarded information. Disagreement between sources is frequently the most informative output available.

‍

Why Does the Join Key Matter More Than the Window?

‍

Because without one, the window is doing all the work and time proximity alone produces coincidence at scale.

‍

In an organization where hundreds of people use AI tools daily, two events five minutes apart are unremarkable unless something ties them to the same person, session or asset. The identifier is what makes the pair informative, and identifiers differ by source, so establishing the mapping is the engineering work that correlation depends on. An AI data fabric is a set of those mappings before it is anything else.

‍

Which Identifiers Are Usually Available?

‍

Corporate email or account identifier across most sources, a device identifier across endpoint and network, and a session identifier within a single tool. The difficulty is that no single identifier spans everything, so a join across four sources is frequently two joins on different keys, and each hop loses records where the mapping is incomplete, which joining across relationships runs into as well.

‍

What Happens to Records That Fall Outside the Window?

‍

They are lost silently, which is the failure mode nobody measures. A correlation that finds nothing looks identical to an environment where nothing happened.

‍

A true pair separated by more than the window produces no finding and no error. The sources both hold their records, the rule ran, and the output is empty. The empty result is what a quiet week produces too, so a window set too narrow reports success indefinitely while missing exactly the events it was built for.

‍

How Would You Detect That?

‍

Check the near misses. Counting pairs that matched on identifier and fell outside the time window gives a direct measure of what the current setting excludes. Where that count is high, the window is too narrow, and the number is available from the same data the rule already reads. Very few programs look at it.

‍

What About Records That Never Arrive?

‍

A separate and larger problem. A source that stops reporting produces the same empty result as a correlation that found nothing, so source liveness has to be monitored independently of the detections built on it. A rule depending on four sources where one has been silent for a fortnight is reporting on three, and the assumption that a source is still reporting decays the same way any other assumption does.

‍

What Does Honest Reporting of a Correlation Look Like?

‍

Stating the window, the key and the coverage alongside the finding, since a correlated event presented without those cannot be evaluated.

‍

A finding that says three sources agreed within a stated window on a stated identifier is checkable. One that says the platform detected an exposure is not. The second reads more confidently and survives scrutiny less well, which matters when the audience is an auditor or a technical reader who will ask how the conclusion was reached. Evidence somebody outside can verify requires the method to travel with the result.

‍

The Window Follows the Mechanism

‍

Exact timestamp matching fails because clocks disagree, pipelines lag and processing is sequential, and byte-level matching fails because a browser counts characters while a network counts encrypted bytes. For AI interactions the floor is set by human composition time, which runs to tens of seconds, and by tunnel accounting that finalizes at teardown. Widening the window buys recall and manufactures false pairs past a point, so the number is a trade rather than a setting, and it belongs to the scenario rather than the platform. Kovrr's AI Security and Governance Platform records the window and the join key against each correlation, which is what allows a finding to be challenged rather than accepted.

‍

To see AI interactions correlated across sources with the window and identifier recorded, book a demo mapped to your own estate.