diff --git a/correlation.py b/src/fgai/correlation.py
similarity index 100%
rename from correlation.py
rename to src/fgai/correlation.py
diff --git a/src/fgai/dashboard.py b/src/fgai/dashboard.py
index 76c036a..cb53e9d 100644
--- a/src/fgai/dashboard.py
+++ b/src/fgai/dashboard.py
@@ -155,7 +155,9 @@ async function refresh() {
   ]);
   const d = data.diagnostics || {};
   const context = data.event_context || {};
+  const correlations = data.cross_source_correlations || [];
   document.getElementById('diagnostics').innerHTML =
+    '<h3>Cross-Source Correlations</h3>' + table(correlations, [{label:'Source IP', key:'source_ip'}, {label:'Streams', render:r => esc((r.streams || []).join(', '))}, {label:'Events', key:'events'}, {label:'Security Events', key:'security_events'}]) +
     '<h3>Entities</h3>' + table(context.source_profiles || [], [{label:'Entity', key:'entity'}, {label:'Events', key:'events'}, {label:'UTM', key:'utm_events'}, {label:'Deny', key:'deny_or_threat_actions'}, {label:'Destinations', key:'distinct_destinations'}, {label:'Actions', render:r => esc((r.top_actions || []).join(', '))}]) +
     '<h3>Security Event Samples</h3>' + table(context.security_event_samples || [], [{label:'Entity', key:'entity'}, {label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'}, {label:'Destination', key:'dst'}, {label:'Service', key:'service'}]) +
     '<h3>Top Sources</h3>' + table(d.top_source_ips || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +