SOC & incident response · Lesson 4 of 5
Build a timeline you can explain
A timeline connects observations from different systems. Before sorting events, check whether their timestamps mean the same thing. A precise-looking time can still be misleading.
Normalize the times before sorting
Two fictional sources use different time zones.
- Original 05:01 UTC−05:00Sign-in → 10:01 UTC
Retain the original timestamp and source.
- Original 10:02 UTCExport → 10:02 UTC
The export is one minute later in normalized time.
- InterpretationOrder is not causation
Account and session evidence are still needed to connect events.
Read the visualWhich comes first here: the 05:01 sign-in or the 10:02 export?
The sign-in is 10:01 UTC, one minute earlier. That order alone does not prove it caused the export.
Keep the original record
Preserve the source, original timestamp, time zone, and relevant event details. Work from copies under the organization’s evidence-handling process.
Compare like with like
Normalize times for comparison, such as to UTC, while retaining originals. Note clock differences, missing records, and uncertainty rather than hiding them.
Connect without overclaiming
Use account, session, and event context to investigate relationships. Two events close together in time do not automatically share a cause.
Put it in context
A fictional app records an export at 10:02 UTC. A sign-in record says 05:01 with an explicit UTC−05:00 offset. That sign-in corresponds to 10:01 UTC, one minute before the export. The order is consistent with a connection, but you still need account and session evidence to support it.
A useful timeline shows what happened, where the record came from, and what remains uncertain.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.