Correlating Across Sources and Building a Timeline

What is it?

Real incidents cross sources: auth says who signed in, the proxy says where they went, EDR says what ran. Correlation lines these up by a shared key (user, host, IP) and time, producing one timeline that tells the whole story.

Why it matters

No single source proves an intrusion; the sequence across them does. A failed-then-successful login is not alarming until the proxy shows exfiltration two minutes later. The timeline is the evidence you hand up.

Where you see it

Combine sources and order by time: `(sourcetype=auth OR sourcetype=proxy OR sourcetype=edr) user=j.rai | sort _time | table _time, sourcetype, action, dest`. The rows interleave into one narrative.

What normal looks like

A benign timeline explains itself: a login, expected app traffic, no unusual process — each event has an innocent neighbour that accounts for it.

What suspicious looks like

A causal chain no benign story explains: foreign login → credential access on the host → large upload to a new domain, all within minutes and all tied to one user. Correlation, not any single line, is the tell.

How analysts investigate

Choose the shared key, pull the relevant sources, order by time into one table, and read the sequence for cause and effect. Then test the story: is there a benign explanation for the whole chain, not just each link?

Common beginner mistakes

Correlating on time alone, mixing unrelated users' events into one false story.
Reporting a scary single event without the timeline that gives it meaning — or missing the benign explanation for the whole chain.

One timeline, many sources

  key = user:j.rai, ordered by _time
  02:14  auth    login success   src=Kyiv        ← foreign login
  02:15  edr     lsass access    host=FIN-07     ← credential access
  02:17  proxy   upload 240MB    dest=new-cdn.io ← exfiltration
  no single line proves it — the CHAIN within 3 minutes does

Correlate on a shared key + time so events from auth, EDR and proxy form one defensible narrative.

Quick check

Which conclusion is defensible enough to escalate?

A quick self-check — it doesn't affect your XP or progress.