The correlation is highly dependent on the accuracy of the timestamps.
Let's imagine:
Firewall: 10:32:14
Server: 10:30:02
EDR: 10:33:47
If the clocks are not properly synchronized, reconstructing an attack becomes more difficult.
Time synchronization is therefore essential. European requirements applicable to certain financial entities even go so far as to require the synchronization of ICT system clocks with a reliable time source.