Log correlation

Connect events without inventing a connection

Log correlation relates records from different sources to answer an investigation question. A sign-in event, an application request, and an endpoint process may describe parts of one activity. Joining them reliably requires compatible identifiers, time interpretation, and an understanding of what each source actually records.

A shared timestamp or address is a starting clue, not a complete relationship. Many people can share an address through a gateway. One person can use several devices and sessions. A process identifier can be reused after the original process exits. Investigators should choose relationships that fit the systems involved.

Follow a document export

In a fictional portal, an application event records an export request with an interaction identifier. A background worker records completion using the same identifier. An identity event identifies the session used to submit the request. Together, these records can connect a requesting identity with a completed business action more strongly than timing alone.

An endpoint upload event occurring shortly afterward is relevant, but it may not share the same identifier. The analyst needs another supported relationship, such as a file path and hash, to link that upload to the export. If that relationship cannot be established, the conclusion should preserve the distinction.

Normalize carefully

Record event time and ingestion time separately when they differ. A delayed source can arrive after later events, making an ingestion-ordered display look like the activity happened in the wrong sequence. Time-zone conversion and clock error can also change apparent ordering.

Normalization makes fields easier to query, but it can erase useful meaning if different source fields are treated as equivalent. A field named “user” might mean the requester in one source and the service executing a job in another. Preserve raw events and document important mappings so analysts can check the original semantics.

Account identifiers should include the relevant tenant, domain, or source context. Two unrelated systems can both contain an account named “admin.” Joining them without a shared identity relationship creates a false narrative.

Test the join

Use a known authorized action to verify the correlation path. Identify which fields should match, acceptable time differences, and how retries or duplicates appear. A query returning several plausible matches may need additional constraints rather than an arbitrary choice of the first result.

For practice, build a small event table for one sign-in, two export requests, and one completed worker job. Give each export a distinct interaction identifier. First correlate using timestamps alone, then use the identifiers and compare the ambiguity.

Explain which facts can be stated confidently and which depend on assumptions. Application security logging supplies meaningful identifiers, while Incident timelines turns the supported relationships into a readable sequence. Security information and event management can help perform the queries, but the analyst remains responsible for interpreting the join.

Related concepts

• Logs and telemetry
• Cloud audit logs