Question

A SOC analyst is correlating events from a web server, a firewall, and a domain controller during an incident investigation. The analyst notices that the sequence of logged events across the three systems does not match the actual order in which the activity occurred, making it impossible to build an accurate timeline. All logs are being forwarded to the same SIEM. Which underlying issue is MOST likely responsible for this problem?

Accepted Answer

The systems are not synchronized to a common time source, causing timestamp drift between log sources

Answer

The SIEM is configured with an insufficient log retention period for the affected sources

Answer

The firewall is logging in a proprietary binary format the SIEM cannot parse

Answer

The domain controller is generating too many events, overwhelming the SIEM ingestion pipeline