all server sending data to the siem should be synchronized with the same time. easier to know when the events occured
the process of obtaining the exact same time on different devices.
crunching the numbers to see if they support predictions