DE.AE-03 says information is correlated from multiple sources. One failed login means little. A failed login from a new country, followed by a mailbox rule change and a large download, means a lot. Correlation links those events so you see the story.
CSF is voluntary guidance. There is no CSF certification.
What good looks like
Logs from different systems land in one place with consistent timestamps and identifiers. Analysts can search a user, device, or IP across all sources at once. Threat intelligence helps match events to known activity. NIST's examples describe sending log data to a small number of log servers and using event correlation technology such as a SIEM.
How to implement it
- Centralize at least identity, cloud audit, endpoint, email, and key application logs.
- Normalize fields so a user or host has the same name everywhere.
- Build three or four correlation rules that join sources, for example a risky sign in plus a new device plus a privilege change.
- Enrich events with asset inventory and, where available, threat intelligence.
- Review rule results monthly and adjust.
A worked example
A finance employee's account shows a login from an unfamiliar country at two in the morning. Taken alone, the identity provider marks it medium risk and the user is asked for a second factor, which the attacker passes using a stolen session. An hour later the email system records a new inbox rule that forwards messages containing the word invoice to an external address. After that, the file sharing service logs a bulk download.
Each system saw one small signal. Correlated by user and time, the three events form a clear business email compromise pattern. Without correlation, each alert sits in a different queue at low priority.
Practical starting point
You do not need a large platform. Pick the identifiers that tie your tools together, usually user email, device name, and IP address. Make sure each log source includes them in the same format. Send the sources to one searchable place. Then write correlation rules for the patterns you fear most, starting with account takeover, malware followed by data movement, and changes to security settings followed by unusual access.
Keep it tuned
Correlation creates new noise if not tuned. Review each rule's results monthly. If a rule never fires, check it still works. If it fires constantly, tighten it or add exclusions for known good behavior, and record the change.
Evidence to collect
- Diagram of log sources feeding the central platform.
- Correlation rule definitions.
- An example investigation that used more than one source.
Common gaps
Logs in five tools with no common identifier. Clocks that disagree by minutes. Rules that look at one source only. Correlation capability bought but never configured.
Quick check
What is the smallest useful correlation setup?
Identity, endpoint, and cloud audit logs in one searchable place, with a shared user identifier and three joined rules.
Sources
- NIST Cybersecurity Framework 2.0 (NIST CSWP 29), DE.AE-03 and its implementation examples.
