Digital › Module 7 › Lesson 2
Correlation
Correlation literacy — join PCAP, logs, disk, and memory rows on UTC and entity keys from $DFIR_LAB practice cases.
Visual · t26_correlation
Correlation = join keys across artifacts. $DFIR_LAB. Original Cyberlium.
Opening
Correlation is where scattered artifacts become a story — join with keys and skepticism, not with unauthorized data.
Correlation literacy joins artifacts via UTC window, hostname, username, IP:port, file hash, process name, and session ID — document join key per row on $DFIR_LAB practice evidence. Example literacy: DNS query in PCAP within ±60s of 4688 process start in log and file write MAC on disk image — three-source row with confidence note (strong/medium/weak). Cyberlium teaches join methodology — NOT assuming causation from coincidence, NOT correlating employer prod logs with lab fiction, NOT 'hacking back' to validate IPs. Purple analyst marks conflicting rows instead of deleting them. Output: correlation matrix or three cross-source rows with join keys explicit.
1. Join keys
UTC ± window, IP, user, host, hash, PID — pick key per pair; document in column.
Weak joins labeled weak — do not upgrade to 'confirmed attacker' without evidence class.
Command guide
Try these commands — Join keys
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Event correlation — https://www.sans.org/cyber-security-skills/digital-forensics/ CISA IR — https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response NIST CFReDS — https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_DFIR=${LAB_DFIR:-$HOME/cyberlium-lab/t26-dfir}
grep 'auth_failure' "$LAB_DFIR/notes/timeline.csv"
grep -E 'sudo|pcap|sample' "$LAB_DFIR/notes/timeline.csv"
python3 -c "print('Correlate timeline rows with fake-log-lines and pcap hash — lab only')"Primary tools to practice this lesson: grep, python3. Reference sites: Event correlation (https://www.sans.org/cyber-security-skills/digital-forensics/); CISA IR (https://www.cisa.gov/topics/cybersecurity-best-practices/incident-response); NIST CFReDS (https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-reference-data-sets-cfreds). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Multi-source rows
Minimum literacy: two sources correlated; stretch: three (net + log + disk).
Module 4 disk and Module 5 memory rows may enter joins when brief provides images.
3. Refused
No correlation using unauthorized evidence, no deletion of contradicting rows.
Correlation supports hypotheses — does not replace legal reporting standards Module 8.
4. What you ship: correlation row template
Join key glossary + three cross-source example rows + confidence column + scope line.
5. What you record before the next lesson
Correlation row template path.
6. Wrong vs right: tampering evidence vs chain of custody
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Delete log row that contradicts your theory before submitting timeline.
Right
Correlation template with explicit join keys on $DFIR_LAB. Next: Hypotheses.
Mission: correlation row template
1) List five join keys. 2) Define confidence weak/medium/strong. 3) Write two cross-source rows from practice case. 4) Write NEVER delete contradicting rows.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “±60s window — when too wide?”
Knowledge Check
APPLY: Correlation uses:
Multiple choice
Knowledge Check
APPLY: True or False: Delete contradicting rows to fit theory.
True or False
Knowledge Check
APPLY: Weak correlation should:
Multiple choice