A campaign provides a comprehensive view of a threat by correlating detection events to identify the different stages of an attack. The MITRE ATT&CK framework is used to classify the threats.