Related alerts from the same user grouped into attack sequences — see the full pattern, not isolated events.