Given below are different steps involved in event correlation. Event masking Event aggregation Root cause analysis Event filtering Identify the…

In event correlation (as applied in SOC/SIEM-driven investigations), the workflow typically starts by

reducing complexity and normalizing what “one incident” looks like before attempting conclusions

about causality. Event aggregation (2) is performed early to combine multiple low-level, related

events (for example repeated authentication failures, repeated firewall denies, or multiple IDS hits

for the same signature) into higher-level “grouped” records. This prevents analysts from treating

every raw log line as a separate incident and makes correlation computationally and operationally

feasible.

Next, event masking (1) suppresses events that are already known to be irrelevant or repetitive in a

way that does not add investigative value (for example, routine scheduled scans, approved admin

tools, or duplicate alerts already represented in the aggregated set). After masking, event filtering (4)

further removes remaining noise using rules, thresholds, whitelists, time windows, or relevance

criteria (scope, asset criticality, and known-benign sources), leaving a cleaner dataset that represents

probable security-relevant activity.

Only after the dataset is consolidated and noise-reduced does root cause analysis (3) become

reliable, because RCA depends on a clear chain of correlated events to identify the initiating action

and propagation path. Hence the correct sequence is 2 → 1 → 4 → 3 (Option B).