Building a Cybersecurity Incident Timeline

Incident timelines transform scattered log entries into a sequence of events that explains what happened, when, and in what order. Building one requires correlating evidence across multiple sources.

Start with known anchors

Begin with confirmed events: when the incident was reported, when specific alerts fired, or when users noticed unusual behaviour. These anchor points provide reference frames for correlating other evidence.

Normalize timestamps

Logs from different systems may use different time zones or clock drift. Normalize all timestamps to a single reference (typically UTC) before correlation.

Layer evidence sources

Combine authentication logs, network flow data, endpoint alerts, and application logs. Each source reveals different aspects of attacker activity.

Identify gaps honestly

Timelines with unexplained gaps are more useful than timelines that fill gaps with assumptions. Mark uncertain periods and note what additional evidence would resolve them.