Correlation Engine (CE) is known as the brain for SIEM, its aggregates, normalizes correlates and analyzes event log data from the myriad of devices within your infrastructure. So, why CE is so important for us in getting the full visibility of our network?  Let me give you one example:-

CE1

1)      Normal IDS will catch the request from attacker

ce2

2) IDS will never see the traffic that has been wrapped by the secure protocol such as SSL

ce3

3) So, with Correlation Engine in place we still can capture the attacker since all the logs from server will be read by CE and it will correlates the events based on the logic inside