How should an incident timeline be built?¶

An incident timeline should be built from original events, preserved timestamps and clearly identified sources.

Evidential caution: that one product’s timeline represents the whole incident.

What this means¶

Different systems may record:

event time;

collection time;

processing time;

alert time;

display time;

local time;

UTC;

provider time.

the original timestamp;

time zone;

clock source;

known drift;

event identifier;

source system;

collection method;

whether the record was later normalised.

Build the timeline from evidence rather than from the expected attack story.

Separate:

first supported activity;

first detection;

first analyst review;

first operational impact;

first containment action;

first recovery action.

Likewise, do not force gaps into a continuous narrative.

Several devices, accounts or operators may overlap.

Where timestamps conflict, record the conflict and explain any correction or conversion.

It should show what is known, what is inferred and what remains unresolved.

Where events are generated by automated systems, identify whether one action produced many downstream records. A management job, cloud workflow or malware task may create repeated endpoint events. The timeline should show the initiating event separately from its automated consequences.

A timeline should also distinguish action from effect. A command may be issued at one time, queued by a platform and executed later on several systems. Recording only the endpoint execution times can hide the earlier controlling decision and make separate events appear unrelated. The operational takeaway is:

Build timelines from source records with time zone and clock context, and keep event, detection, response and inference clearly separated.

================================================================================

What to check or do next¶

• Investigators should preserve:

Evidential limits¶

It may not.

Do not assume events close together belong to the same session.

A defensible timeline can contain uncertainty.