2.1.1. Log Ingestion and Time Synchronization
💡 First Principle: Logs are only useful for correlation and forensics if they share a common time reference — without time synchronization, reconstructing the sequence of events across multiple systems becomes unreliable or impossible.
Imagine investigating an intrusion that touched five systems. You pull logs from each and try to build a timeline of what happened. If three systems are synchronized to NTP but two are 7 minutes off, you'll either miss correlations (events that actually overlapped appear to be separate) or create false correlations (events that happened at different times appear simultaneous). Time is the foundation of every multi-source investigation.
Network Time Protocol (NTP) is the standard mechanism for time synchronization. Every device in an enterprise environment should sync to a reliable NTP hierarchy. Domain-joined Windows systems automatically sync via Active Directory; network devices need explicit NTP server configuration. Forensically, time skew is documented and factored into analysis — but it complicates everything.
Logging levels control the verbosity and volume of log output:
| Level | Captures | Use Case |
|---|---|---|
| DEBUG | Everything, including verbose application internals | Development/troubleshooting only — far too noisy for production SIEM |
| INFO | Normal operational events | Standard operational visibility |
| WARNING | Non-critical abnormalities | Worth monitoring; indicates something unexpected |
| ERROR | Failed operations | High-priority review |
| CRITICAL | Severe failures requiring immediate attention | Alerting threshold |
For CySA+ purposes: DEBUG logs in a SIEM create alert fatigue and storage costs. Production log ingestion typically targets INFO and above, with specific DEBUG logging for high-value targets during active investigations.
Log ingestion architecture: Logs flow from sources (endpoints, network devices, applications) through collectors/forwarders to a centralized SIEM. The SIEM normalizes format differences (CEF, LEEF, syslog, JSON) and correlates events across sources. Missing a single log source = missing detections for that segment.
⚠️ Exam Trap: Time synchronization failures don't just cause inconvenience — they can make evidence inadmissible in legal proceedings and undermine the credibility of incident timelines. When the exam asks about log analysis prerequisites or forensic challenges, time sync is always a candidate answer.
Reflection Question: Two systems show a suspicious sequence of events: System A logs an authentication at 14:32:05, and System B shows a process execution at 14:31:58. System B's clock is known to be 2 minutes behind NTP. Is this sequence consistent with an attacker moving from System A to System B? Explain your reasoning.
