What is log correlation?

What is log correlation?

• A. The process of combining log data from multiple sources to identify patterns or timelines indicating an incident.
• B. The practice of encrypting logs for confidentiality.
• C. A method to delete outdated logs to save space.
• D. A technique to separate logs by source without correlation.

Answer: (A)

Log correlation is the process of aggregating and analyzing log data from multiple sources to uncover relationships and timelines that indicate an incident. By bringing together logs from different systems—firewalls, authentication servers, endpoints, applications—you create a unified view of events. This helps you see how actions across diverse components fit together, such as a failed login on one device followed by a successful access from a new IP, or unusual activity appearing in several systems within a short window. Such cross-source analysis reveals patterns that single logs might not show, enabling faster detection and a clearer picture of the incident’s scope. The other options describe separate practices: encrypting logs for confidentiality, deleting old logs to save space, and separating logs by source without linking them, none of which provide the coordinated view that log correlation delivers.

Log correlation is the process of aggregating and analyzing log data from multiple sources to uncover relationships and timelines that indicate an incident. By bringing together logs from different systems—firewalls, authentication servers, endpoints, applications—you create a unified view of events. This helps you see how actions across diverse components fit together, such as a failed login on one device followed by a successful access from a new IP, or unusual activity appearing in several systems within a short window. Such cross-source analysis reveals patterns that single logs might not show, enabling faster detection and a clearer picture of the incident’s scope. The other options describe separate practices: encrypting logs for confidentiality, deleting old logs to save space, and separating logs by source without linking them, none of which provide the coordinated view that log correlation delivers.