diff --git a/src/correlate.mjs b/src/correlate.mjs
new file mode 100644
index 0000000..1dae328
--- /dev/null
+++ b/src/correlate.mjs
@@ -0,0 +1,19 @@
+import { normalizeEvent } from './model.mjs';
+import { advance } from './state.mjs';
+
+export function correlate(rawEvents) {
+  const rejected = [], valid = [];
+  for (const [index, raw] of rawEvents.entries()) {
+    const item = normalizeEvent(raw, index);
+    if (item.error) rejected.push(item);
+    else valid.push(item);
+  }
+  valid.sort((a, b) => a.time - b.time || a.index - b.index);
+  const groups = new Map();
+  for (const event of valid) {
+    const key = `${event.device}/${event.alarmId}`;
+    const initial = groups.get(key) ?? { open: false, firstAlarm: null, acknowledged: false, anomalies: [] };
+    groups.set(key, advance(initial, event));
+  }
+  return { groups, rejected };
+}