What is causation versus correlation in a timeline?¶

Correlation means that two events are associated by time, identifiers or context. Causation means that one event produced or contributed to the other.

A timeline can show correlation more easily than it proves causation.

Avoid the dangerous assumption¶

The dangerous assumption is that because one event followed another, the first must have caused the second.

That conclusion may be unsupported.

A login may occur before a file deletion, but another session, scheduled task or administrator may have caused the deletion. A network connection may appear before a malware alert, but both may result from a separate process.

Causation is stronger where the system design, identifiers and event sequence show a direct chain. A request ID may link a user action to an application process and then to a database change. Process ancestry may show that one executable launched another.

Investigators should ask what technical mechanism connects the events. Time proximity is supportive but rarely sufficient by itself.

Use correlation IDs, session IDs, process relationships, transaction records and field definitions. Consider alternative causes, parallel activity and automation.

Report the distinction clearly. It may be accurate to say that two events occurred within the same session or time window while remaining uncertain whether one caused the other.

Where causation is inferred, explain the evidence supporting the inference and any remaining limitation. Do not use timeline order alone as proof.

Operational takeaway¶

A timeline can demonstrate association and sequence, but causation requires a supported technical mechanism linking the events rather than mere proximity or chronological order.