Which of the following definitions best describes the concept of log correlation?

Question

Options

• ACombining relevant logs from multiple sources into one location
• BSearching and processing data to identify patterns of malicious activity
• CMaking a record of the events that occur in the system
• DAnalyzing the log files of the system components

• B
  94% (34)
• C
  3% (1)
• D
  3% (1)

Explanation

Log correlation is the process of searching and analyzing log data across systems to identify patterns, relationships, and sequences that indicate malicious or anomalous activity - making B correct. A single log entry rarely tells the full story; correlation connects dots across time and sources to surface threats like a failed login followed by privilege escalation.

Why the distractors are wrong:

• A describes log aggregation (collecting logs into a central system like a SIEM) - a prerequisite to correlation, not correlation itself.
• C describes logging or audit logging - the act of recording events, which happens before any analysis.
• D describes log analysis in a general sense, but analysis alone lacks the "connecting patterns across sources" element that defines correlation.

Memory tip: Think of "correlation" like connecting dots - you're not just gathering logs (A), writing them (C), or reading them (D); you're linking patterns across them to expose what an attacker is doing. If the definition involves finding relationships or patterns of behavior, it's correlation.

No community discussion yet for this question.