What is causation versus correlation in a timeline?¶

Correlation shows that events are associated by time, identity or context. Causation requires evidence that one event produced or contributed to another through a technical mechanism.

Sequence alone does not establish cause¶

A login before a deletion does not show that session deleted the file; another session, task or administrator may have acted. A network connection and malware alert can share a preceding process without either causing the other.

Time proximity supports investigation but rarely resolves these alternatives.

Look for the connecting mechanism¶

Request and transaction IDs can link input to application and database changes. Process ancestry can show one executable launching another. Session, message and correlation IDs plus system design can establish a supported chain.

Test parallel activity, automation and alternative controllers. Where the record proves only that events occurred in one session or window, say so. If causation is inferred, state the mechanism and remaining limits instead of relying on chronological order.