Stop 07 · Security Operations & MonitoringTopics · 3/10

Log Analysis & Correlation

In short

One log line rarely proves an attack. The story appears only when you line up events from different systems and see them fit together like clues.

Connecting related events across multiple log sources to identify an attack that no single log entry would reveal alone — the core analytical skill behind effective SIEM use.

The blob pins clues and strings onto a detective board, linking them into a line.

Think of it like this

The detective's string board

A single CCTV frame of a man near a gate proves nothing. But the gate log, the lift log and the parking record, placed in order, show one person moving step by step. Correlation is pinning those separate clues into one timeline.

Watch it happen

Three logs tell one story

Firewall

Web server

allow 203.0.113.5

1/5Firewall logs a connection from an outside address at 02:11.

The big ideas

What you need to know

Time is the glue

Correlation lines events up by time. If clocks disagree, the story falls apart, so sync every clock to UTC.

Shared keys join logs

A username, session id or source IP that appears in several logs lets you stitch them into one chain.

Base lines first

You can only spot odd behaviour if you know normal. Learn the usual traffic before hunting the unusual.

Cut the noise

Most lines are routine. Filter aggressively so the few meaningful events stand out.

See it in code

Walk through the code

text

1# Splunk: join firewall and web logs by source IP in a 5 min window2index=firewall OR index=web3| transaction src_ip maxspan=5m4| search eventcount > 305| table _time, src_ip, index, eventcount

1/3Pull events from both the firewall and web indexes together.

transaction groups events from both indexes that share a source IP within five minutes, so a burst across firewall and web shows as one chain.

Save yourself the pain

Common mistakes

Oops

Reading one log source in isolation.

Do this instead

Attacks cross systems. Pull firewall, server and database logs together before you decide what happened.

Oops

Ignoring clock drift between machines.

Do this instead

Even a one minute skew scrambles the order of events. Keep every system on NTP and store times in UTC.

Your mission

Correlate a login spike

~35 min

Quick check

Two servers log the same attack but their clocks differ by three minutes. What breaks?

Go deeper

1Practice correlating a login event with a subsequent suspicious action in sample log data.
2Learn why an isolated log entry often looks benign, but a correlated sequence reveals an attack.
3Build a mental checklist of what 'normal' looks like so anomalies stand out faster.