What is event correlation?¶

Event correlation is the process of linking records that may relate to the same activity, account, device, session, transaction or incident.

The purpose is to build a stronger understanding than any one log entry can provide.

Avoid the dangerous assumption¶

The dangerous assumption is that events occurring close together automatically belong to the same cause or person.

They may not.

Correlation can use timestamps, account identifiers, device names, IP addresses, session IDs, request IDs, file hashes, message IDs and other shared values. A successful login, application action and database change may form one connected chain.

That can help investigators reconstruct sequence, identify missing stages and test an explanation. It can also reveal when one event in one system produced consequences elsewhere.

But every linking field has limitations. Accounts may be shared. IP addresses may represent many devices. Device names may be duplicated. Session and request identifiers may have limited scope.

Investigators should establish why two records are being linked. Record the matching fields, timing, source systems and any assumptions. Prefer several independent points of agreement rather than one weak match.

Check whether one system imported data from another. Two apparently separate records may be duplicate representations of the same source event rather than independent observations.

Where records do not align, do not force them together. Consider different clocks, delayed ingestion, retries, automation and unrelated activity.

Operational takeaway¶

Event correlation links records through shared identifiers, sequence and context, but investigators must explain the basis of the link and avoid treating proximity or one matching field as proof of a common cause.