How should I build a timeline from cloud records?¶

Build a cloud timeline by preserving each source record, normalising time for comparison and linking events through identifiers and context. A simple chronological sort of one export is not a complete reconstruction.

Keep source facts separate from interpretation¶

Retain the original timestamp, time zone, provider event name, raw description and identifiers. Add converted time and interpretation in separate fields so the timeline still shows what the source actually said.

A useful working structure records:

Field group	Examples
Source	provider, service, tenant, export or disclosure
Event	original time, zone, event type, result, event ID
Actor and access	account, session, token, application, IP address
Target	resource ID, name, version or parent
Analysis	linked event, confidence, gap or alternative explanation

Link systems without inventing precision¶

Authentication, token, application, API and resource logs may record different stages of one action. Event, request and correlation IDs provide the strongest joins; shared account, resource, address and close timing provide contextual joins whose limitations should be stated.

Separate the underlying action from later provider processing, alert generation and export time. Automated sync or token refresh should not be rewritten as a new human action.

Check time zones, clock quality, retention gaps, disabled logging and export filters. Where ordering remains uncertain, use a range or competing sequences rather than forcing exactness. Compare the cloud sequence with device, communications, organisational and real-world evidence where relevant.