An attack moved through three cloud accounts in two regions over several hours. Investigators have logs from all of them, but cannot reconstruct the sequence of events because each source records time differently and uses different field names for the same identity. Which capability is most needed?
Select an answer to reveal the explanation.
Short Explanation
You've got all the puzzle pieces, but they're from three different boxes with three different pictures on the lid. Correlation normalizes the fields and lines up the timestamps so you can finally see the attacker's path step by step. More data won't help until the data you've got speaks the same language.
Full Explanation
Log correlation links related events across multiple sources to reveal patterns and sequences that no single source shows. It depends on normalization, mapping differently named fields such as user, principal or caller to a common schema, and on consistent time, meaning synchronized clocks and timestamps converted to a single reference such as UTC. A SIEM performs this parsing and normalization at ingestion, then correlates events by identity, resource and time window so investigators can follow lateral movement across accounts and regions. The investigators already have the logs; their obstacle is that the logs cannot be joined, so the capability needed is correlation rather than more collection. Adding full request and response payloads increases volume and sensitivity without resolving inconsistent field names or time formats. Regional retention policies address legal and residency requirements, which matter, but they do nothing to align events into a timeline. Packet capture at internet gateways would show external traffic but not activity within and between accounts through the management plane, and it would introduce yet another source needing correlation. Exam caveat: time synchronization across all systems is a foundational requirement for credible forensic timelines. Operational check: run a correlation search for a single identity across all accounts and confirm events appear in a single, correctly ordered timeline.