Incident timeline
An incident timeline is a chronological account of relevant events and response actions, with references to the evidence supporting each entry and any uncertainty about their timing or interpretation.
Put each event in context
A useful timeline shows the sequence of events and the accounts or assets involved. NIST also recommends recording investigation actions and preserving the integrity and origin of the supporting records.
For each entry, keep the source, account or asset, action, timestamp, and outcome. Separate what the record says from what you think it means. A ticket saying that a caller claimed to be an employee does not prove the employee made the call.
Check the clocks before connecting events
Before sorting records from different systems, check each source’s time zone, what its timestamp represents, and any known clock differences.
An account-recovery event followed by a sign-in gives you an order to investigate. You still need evidence linking the two: the sequence alone cannot establish that the same person performed both actions. Application records can then help establish what happened after sign-in.
Keep original timestamps when converting to a common time zone. Where available, distinguish event time from collection or ingestion time. NIST’s forensic guidance explains why these system-time details matter.
Mark gaps, approximate times, missing sources, and conflicting records. Include containment changes, and link each entry to its source so another analyst can follow the reasoning.