312-39 · Question #45
You are part of a team of SOC analysts in a multinational organization that processes large volumes of security logs from various sources, including firewalls, IDS, and authentication servers. Your…
The correct answer is C. Log correlation. Log correlation is the capability that links related events from different sources into a coherent narrative based on predefined rules, logic, and time windows. In SOC operations, incidents rarely appear as a single log line; they are sequences-failed logons followed by a…
Question
You are part of a team of SOC analysts in a multinational organization that processes large volumes of security logs from various sources, including firewalls, IDS, and authentication servers. Your team is having difficulty detecting incidents because logs from different systems are analyzed in isolation, making it harder to link related events. What approach should you implement for future investigations to automatically match related log events based on predefined rules?
Options
- ALog normalization
- BLog collection
- CLog correlation
- DLog transformation
How the community answered
(25 responses)- A4% (1)
- B8% (2)
- C88% (22)
Explanation
Log correlation is the capability that links related events from different sources into a coherent narrative based on predefined rules, logic, and time windows. In SOC operations, incidents rarely appear as a single log line; they are sequences-failed logons followed by a successful logon, then privilege changes, then suspicious process execution, then outbound connections. Correlation rules connect these across data sources (firewall, IDS, authentication, endpoint) using strong keys such as user, host, IP address, session identifiers, and tightly bounded timestamps. This reduces analyst workload, increases detection fidelity, and shortens investigation time by presenting connected evidence rather than isolated alerts. Log collection simply gathers logs; it does not relate them. Log normalization ensures consistent fields and formats, which improves correlation effectiveness, but it is not the linking step itself. Log transformation is a broader term that can include parsing and enrichment, but it does not inherently perform the rule-driven linking of related events. Because the question explicitly asks for “automatically match related log events based on predefined rules,” log correlation is the correct approach.
Topics
Community Discussion
No community discussion yet for this question.