Question

A cloud SOC team is correlating security events across dozens of virtual machines, containers, and managed PaaS services spread over three regions. During a recent investigation, analysts found that events from different sources appeared out of order, making it impossible to reconstruct an accurate attack timeline. Which foundational control should the SOC implement FIRST to ensure reliable cross-source event correlation?

Accepted Answer

Enforce consistent time synchronization across all log sources using a trusted NTP hierarchy and record timestamps in UTC

Answer

Increase the log retention period in the SIEM so older events remain available for correlation

Answer

Deploy additional SIEM parsers to normalize log field names from each source

Answer

Route all log traffic through an encrypted TLS tunnel to protect logs in transit