A computer-implemented method for managing a correlation data structure to detect and mitigate attacks on a machine of a plurality of machines, the method comprising: for each machine in the plurality of machines, detecting a first feature set event (320; 940) in a feature set from one or more machine state snapshots, the one or more machine state snapshots including state data associated with one or more signals associated with one or more sources available to the machine, the feature set including one or more feature set events identified in the state data; accessing a correlation data structure that includes a plurality of relationship correlations; identifying a first relationship correlation from the plurality of relationship correlations, the first relationship correlation corresponding to the first feature set event, a first alert condition from a plurality of alert conditions, and a first time of influence associated with correlating the first feature set event and the first alert condition, and the first relationship correlation having a first relationship score; determining whether the first relationship score meets or exceeds a predetermined threshold score; and upon determining the first relationship score meets or exceeds the predetermined threshold score, taking one or more actions to mitigate the first alert condition, characterized in that the plurality of relationship correlations reflect relationships between a plurality of feature set events (214; 350) detected on one or more machines of the plurality of machines and the plurality of alert conditions (212; 352) detected on the one or more machines of the plurality of machines, and the relationship correlations are based at least in part on a time of influence (210; 356) associated with each correlating feature set event from the plurality of feature set events and each correlating alert condition from the plurality of alert conditions, the correlation data structure also including a predetermined relationship score (220; 365) for each relationship correlation that reflects a relative value for each relationship correlation in the correlation data structure, wherein the time of influence (210; 356) associated with a feature set event and an alert condition indicates a difference in time between occurrence of the feature set event and occurrence of the alert condition. for each machine in the plurality of machines, detecting a first feature set event (320; 940) in a feature set from one or more machine state snapshots, the one or more machine state snapshots including state data associated with one or more signals associated with one or more sources available to the machine, the feature set including one or more feature set events identified in the state data; accessing a correlation data structure that includes a plurality of relationship correlations; identifying a first relationship correlation from the plurality of relationship correlations, the first relationship correlation corresponding to the first feature set event, a first alert condition from a plurality of alert conditions, and a first time of influence associated with correlating the first feature set event and the first alert condition, and the first relationship correlation having a first relationship score; determining whether the first relationship score meets or exceeds a predetermined threshold score; and upon determining the first relationship score meets or exceeds the predetermined threshold score, taking one or more actions to mitigate the first alert condition, characterized in that the plurality of relationship correlations reflect relationships between a plurality of feature set events (214; 350) detected on one or more machines of the plurality of machines and the plurality of alert conditions (212; 352) detected on the one or more machines of the plurality of machines, and the relationship correlations are based at least in part on a time of influence (210; 356) associated with each correlating feature set event from the plurality of feature set events and each correlating alert condition from the plurality of alert conditions, the correlation data structure also including a predetermined relationship score (220; 365) for each relationship correlation that reflects a relative value for each relationship correlation in the correlation data structure, wherein the time of influence (210; 356) associated with a feature set event and an alert condition indicates a difference in time between occurrence of the feature set event and occurrence of the alert condition.