Question

A security analyst is investigating a suspected multi-stage intrusion that touched a web server, an application server, and a database server. When correlating events across the three systems' logs in the SIEM, the analyst finds that the reconstructed timeline is inconsistent — some downstream events appear to occur before their upstream causes. Which condition is MOST likely undermining the analyst's ability to accurately correlate the log data?

Accepted Answer

The three servers are not synchronized to a common authoritative time source

Answer

The SIEM is applying default log retention limits that truncate older events

Answer

The logs were collected using unauthenticated rather than authenticated scans

Answer

The servers are logging at the informational level instead of the debug level