For log correlation to be effective, events from different devices must be placed in the correct chronological order. This requires all logging devices and the FortiAnalyzer to have synchronized system clocks. Using a Network Time Protocol (NTP) server ensures that all devices share a common, accurate time source. This synchronization is fundamental for FortiAnalyzer to accurately correlate log entries from various sources and reconstruct the precise sequence of events for analysis, reporting, and incident response.

A. Use DNS: DNS resolves hostnames to IP addresses, which is necessary for communication but does not ensure the time synchronization required for log correlation.

B. Use host name resolution: This is a general term for name-to-IP mapping (like DNS). It is unrelated to the time-stamping accuracy needed for correlating log data.

C. Use real-time forwarding: While real-time forwarding ensures logs are sent promptly, it does not correct inaccurate timestamps on the logs themselves, which would still prevent proper correlation.

1. FortiAnalyzer 7.4.0 Administration Guide

Page 101

"System Information widget": This section details the importance of system time and configuring NTP. It states

"The System Time widget displays the FortiAnalyzer system time and allows you to configure the system time and an NTP server." This highlights NTP as the mechanism for time management.

2. FortiOS 7.4.0 Administration Guide

Page 103

"Settings": This guide for the logging device (FortiGate) emphasizes the importance of time synchronization for logging. It states

"It is important to have the correct time on your FortiGate

especially for logging... You can manually set the FortiGate's system time or configure the FortiGate to automatically synchronize its clock with a Network Time Protocol (NTP) server." This directly links correct time via NTP to the quality of logs sent to FortiAnalyzer.

3. FortiAnalyzer 7.4.0 Administration Guide

Page 138

"Adding devices": The guide implicitly requires correct time settings for proper device management and logging. While not using the word "correlation" in this specific sentence

the entire function of analyzing logs from multiple devices depends on it. The prerequisite is that devices are "configured to send logs to FortiAnalyzer

" and as per the FortiOS guide

proper configuration for logging includes time synchronization.