Anchor Event
Definition
A log entry that can be identified with high confidence across two or more log sources, used to verify relative clock offsets and to stitch independently parsed logs together into a single timeline. A login event that appears in both an application log and a firewall log is a typical anchor.
- Function
- Cross-verifies relative clock offsets
- Requirement
- Identifiable in two or more log sources
- Typical example
- A login event in both app and firewall logs
- Use
- Stitching independent logs into one timeline
Common questions
Why is an anchor event needed when every log already carries its own timestamp?+
Individual systems often run on unsynchronised or drifted clocks, so their raw timestamps cannot simply be laid side by side. An event visible in two logs at once gives a known point to calculate the offset between their clocks before merging the records.
What makes an event a good candidate to anchor a timeline?+
It needs a unique, unambiguous fingerprint, such as a specific username and source IP appearing together, so the analyst can be confident it is the same real-world occurrence in both logs rather than two similar but unrelated events.
Related terms
- Clock Skew
- The difference between a device's local clock and a trusted reference time such as UTC. Skew accumulates due to hardware drift, timezone...
- DHCP Lease Log
- A record maintained by a Dynamic Host Configuration Protocol server that maps each IP address assignment to the requesting device's MAC address,...
- Log Normalisation
- The conversion of log entries from their native format into a common schema, typically a structured record with a corrected UTC timestamp,...
- NAT (Network Address Translation)
- A mechanism by which a router replaces private source IP addresses with a single public IP address before forwarding packets to the...
- Session Tuple
- The five-element identifier for a network session: source IP, source port, destination IP, destination port, and protocol. The session tuple is the...