Glossary: Logs and Data Sources for Investigations

Correlation

Also written: correlation rules, correlate

Linking events from different sources by something they share, such as an address, account, file name or time. The address 198.51.100.77 tied together the mail, firewall, web, authentication, DNS, IDS and flow evidence.

Where the book teaches it

Chapter 4: Security Tools, Dashboards, Packet Captures and Integrity
Chapter 5: System Images, Stakeholders and Log Parsing

Related terms

SIEM (security information and event management)Normalization Log parsing