Glossary: Security Operations and Incident Response
Correlation
Also written: correlating, correlation rule
Lining up separate records by time to see what really happened. Examples: Sam's badge exit beside a later remote sign-in, or a SIEM rule that links several events.
Where the book teaches it
Related terms
SIEM (security information and event management)NTP (Network Time Protocol)Physical access