What is the difference between log correlation and event correlation in SIEMs?

• A. Log correlation analyzes individual events only.
• B. Event correlation uses broader dataset across logs.
• C. Event correlation links single events in time; log correlation analyzes patterns across logs for anomalies; both enable detection.
• D. They are unrelated processes.

Answer: (C)

In SIEM, correlation means connecting pieces of security data to reveal what happened, rather than treating each event in isolation. Event correlation links related events that occur over time to form a sequence or chain that indicates an incident, such as a login attempt followed by a successful access from a new IP. Log correlation looks across many logs and data sources to detect patterns or anomalies that emerge only when you compare information from different systems, like unusual activity spanning authentication, network, and endpoint logs. Together, these approaches enable detection by capturing both the temporal relationships between events and cross-source patterns. For example, a series of failed logins and then a successful breach on the same host is the kind of sequence event correlation highlights, while a cross-source pattern of suspicious behavior across multiple logs is what log correlation detects. The other options misstate the scope or relationship: log correlation is not limited to single events, event correlation is not confined to a broad dataset across logs, and they are not unrelated processes.