What is log correlation in SIEM and its purpose?

• A. Replacing skilled analysts.
• B. Combining and analyzing logs from multiple sources to identify correlated events, detect complex threats, and prioritize responses.
• C. Storing all logs in a central repository.
• D. Generating random alerts for testing.

Answer: (B)

Log correlation in SIEM is about linking events from many different logs to see relationships and patterns that aren’t obvious when looking at a single source alone. The purpose is to identify sequences or combinations of activities that together indicate a security incident, even if each event alone seems harmless. By normalizing data from diverse sources and applying correlation rules or analytics, the system can detect complex threats, such as credential abuse or multi-stage attacks, and assign risk scores to help responders prioritize investigations.

This is different from merely storing logs in one place, and it’s not about generating random alerts. It also doesn’t replace skilled analysts; it amplifies their effectiveness by highlighting meaningful patterns and reducing alert fatigue.