Three boring lines#
Somewhere on your network tonight, three things happen.
- A badge reader logs an entry to the building at 02:14.
- A domain controller logs a successful login for a user at 02:16.
- A file server logs a large download at 02:19.
Not one of those is suspicious. People work late, downloads happen. Each sits in a different system, watched by nobody, and each is entirely normal on its own.
Now add one fact: that user badged in from an office in another country at 09:00 the same morning, and is still there.
Nothing about the three log lines changed. What changed is that somebody put them side by side. That is correlation, and it is the entire reason a SIEM exists.
What a SIEM actually does#
SIEM stands for security information and event management, and it is usually said as "sim". Strip the acronym and it does four things in order:
- Aggregation. Collects logs from everywhere into one place: servers, firewalls, endpoints, applications, cloud services, badge readers.
- Normalisation. Rewrites wildly different log formats into a common structure, so a firewall's idea of "source address" and a web server's idea of it become the same searchable field. Without this step you cannot query across sources at all.
- Correlation. Applies rules across those normalised events to spot patterns no single event shows.
- Alerting and reporting. Raises something a human should look at, and produces the evidence an auditor will ask for.
Aggregation is collecting. Correlation is connecting. A question describing "events from multiple sources combined to identify a single attack pattern" is describing correlation, not aggregation.
A related term worth knowing: SOAR, security orchestration, automation and response. Where a SIEM tells a human that something happened, SOAR runs the response automatically, such as disabling an account or isolating a host without waiting for someone to wake up.
Why clock synchronisation is a security control#
Correlation depends on being able to put events in order. If the badge reader thinks it is 02:14 and the domain controller thinks it is 01:47, then your timeline is fiction, and every rule built on sequence silently produces nonsense.
So NTP, the Network Time Protocol, is not housekeeping. It is what makes log analysis possible at all, and it has two consequences the exam likes:
- Every log source must sync to the same time source. Any device with a drifting clock becomes useless for investigation, and worse, misleading.
- Timestamps should be recorded in UTC or carry an explicit offset. An investigation spanning several regions with local timestamps and no offsets is an ordering problem you cannot solve after the fact.
This is also why an attacker who gains sufficient privilege may alter timestamps or clear logs. Detecting that is why logs get shipped off the device that generated them, promptly, to somewhere the attacker does not control.
False positives, false negatives, and tuning#
Two terms get mixed up constantly, and the fix is to notice that the word false describes the alert, not reality.
| Term | What happened | Cost |
|---|---|---|
| True positive | Alerted, and it was real | The system working |
| False positive | Alerted, and it was nothing | Wasted time, and eventually ignored alerts |
| False negative | Did not alert, and it was real | The attack you never saw |
| True negative | Did not alert, nothing happened | Normal quiet |
A false negative is obviously worse in a single instance. The catch, and the reason tuning is a real job, is that too many false positives eventually produce false negatives. An analyst facing nine hundred alerts a day stops reading them carefully, and the real one arrives in a queue nobody trusts. This is alert fatigue, and it is a genuine cause of missed breaches rather than a figure of speech.
So tuning is not "making alerts quieter to look good". It is keeping the signal readable enough that a human still reacts.
What to log, and for how long#
Logging everything forever is not a plan, because storage costs money and enormous volume slows the searches you need during an incident. The exam expects you to know the common sources and the tension in retention.
| Source | What it is good for |
|---|---|
| Authentication logs | Failed logins, unusual hours, impossible travel, privilege use |
| Firewall and network flow data | What talked to what, and how much left the building |
| Endpoint detection and response | Process execution, what actually ran on a machine |
| Application and web server logs | Injection attempts, abuse of a specific service |
| DNS queries | Lookups of attacker infrastructure, including beaconing patterns |
Retention is the part that bites. Intrusions are frequently discovered long after they began, so a 30-day retention window against a months-old compromise means the evidence of the initial entry has already been deleted by your own policy. Retention periods are often set by regulation or contract rather than by preference, which is why this crosses into Domain 5.
One more control that sounds dull and is not: logs should be write-once or otherwise tamper-evident, and shipped off the originating device. An attacker with administrator rights on a server can edit that server's logs. They cannot easily edit the copy that already left.
Collecting logs is aggregation and connecting them is correlation, and neither works if the clocks disagree.
Test yourself in the free Kestrel Exams app
Topic-selectable practice — offline, no ads, no account.
Practice this topic →Frequently asked questions#
What does a SIEM do?
It aggregates logs from many sources into one place, normalises their different formats into a common structure, correlates events across them to spot patterns no single log shows, and raises alerts and reports. The correlation step is the one that provides the value, because individually harmless events frequently form a single attack pattern.
What is the difference between aggregation and correlation?
Aggregation is collecting logs from multiple sources into one place. Correlation is connecting events across those sources to identify a pattern. A question describing events from several systems combined to reveal one attack is describing correlation. Aggregation alone just gives you a bigger pile.
What is the difference between a false positive and a false negative?
A false positive is an alert that fired when nothing was wrong. A false negative is a real attack that produced no alert. False negatives are worse individually, but excessive false positives cause alert fatigue, which produces false negatives in practice because analysts stop trusting the queue.
Why does NTP matter for security?
Correlation depends on ordering events in time. If log sources disagree about the current time, the reconstructed timeline is wrong and every rule based on sequence produces unreliable results. Synchronising all sources to the same time reference, and recording timestamps in UTC or with an explicit offset, is what makes cross-source investigation possible.
What is the difference between SIEM and SOAR?
A SIEM collects, correlates and alerts, leaving a human to decide what to do. SOAR, meaning security orchestration, automation and response, executes the response automatically, such as disabling an account or isolating a host. SOAR is commonly layered on top of a SIEM rather than replacing it.
Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written — several of these exist because somebody asked.