Study. uk . com
  1. Home
  2. All questions
  3. Question 513

CompTIA Security+ study material · question 513 of 611

Why is log normalisation necessary before correlation?

  1. It removes sensitive fields
  2. It signs each entry for integrity
  3. It converts entries from different products into a common structure
  4. It reduces storage requirements
Show the answer

Answer: C. It converts entries from different products into a common structure

Correlating a firewall log with an authentication log requires the same field to mean the same thing in both.

Source: NIST SP 800-92 (NIST) — SP 800-92 § 3.2 Functions

Challenge yourself on this topic → Study as cards