Abstract: Methods and systems described herein correlate an incoming alert, regarding events that affect service performance, availability, and security in a cloud services platform, with an existing incident record, stored in remote storage, to enable improved incident handling. Alert information is applied to machine-learning models to correlate the incoming alert to a parent incident record. In rule-based correlation, a local cache stores query signatures (keys) and information related to respective incident records (values). A correlation rule is retrieved for the alert, and a correlation query is constructed based on the alert and the rule. A query signature is generated and used as a cache key to access information about a respective parent incident in storage. If the parent information is not found in the cache, the remote storage is searched for the parent incident record using the correlation query. The alert and correlated parent incident record are associated in remote storage.