A security analyst is investigating a suspected breach that spans multiple servers, firewalls, and endpoints. Each device stores logs locally in different formats, making it difficult to build a timeline of events. Which activity would most directly address this problem going forward?