Question

What is a key consideration when correlating event data from multiple sources into security information and event management (SIEM)?

Answer 1

Answer:

Time synchronisation.

Explanation:

Security information and event management (SIEM) is an application service that analyses the real time security alert in a network, which combines both security information management (SIM) and security event management (SEM).

Correlating is SIEM is a function of the SEM component that integrates sources of events, using attributes and common links to make it a useful source of data. It links these events from multiple sources, considering the time synchronisation of the events.

Time synchronisation is a process of coordinate independent clocks event signals due to clock drift, to avoid clock timing at different rate.