Forensic Timeline
Reconstruct the order of events around an endpoint or a user, and export the sequence as evidence.
What the Forensic Timeline Is#
The forensic timeline reconstructs what happened on an endpoint, in order. It is the step between noticing a signal and explaining it: an alert tells you something changed, the timeline tells you what changed first.
The timeline is built from collected events only. It does not infer, and it does not fill gaps with assumptions, so an incomplete timeline means incomplete collection rather than a hidden event.
Building a Timeline#
- 1Choose the anchor
Start from an endpoint or a user. The timeline is always relative to an asset, because an event without an asset has no context.
- 2Set the window
Choose a time range around the event you are investigating. A window that is too wide hides the sequence you are looking for.
- 3Filter the event types
Reduce the timeline to the event families that matter. A process and network view is often enough to explain a signal.
- 4Read in order
Read events in chronological order and look for causation, not only for proximity. Two events a second apart are not necessarily related.
- 5Export before you close
Export the timeline when it supports a decision, so the evidence survives the retention window.
Event Types#
Six event families are available in the timeline. Combine them to explain a sequence:
| Event family | What it records |
|---|---|
| Process events | Process start and stop, with the command line and the parent process. |
| File events | File creation, modification, and deletion in watched locations. |
| Network events | Connection attempts and external destinations observed on the endpoint. |
| Authentication events | Sign-ins, privilege changes, and failed attempts. |
| Policy events | Policy changes applied to the endpoint and the resulting state. |
| Action events | Scripts, automations, and remote operations performed on the endpoint. |
Export and Evidence#
- Export the filtered timeline when it supports a decision, an incident report, or a regulatory response.
- Include the endpoint, user, and time window in the export, because a timeline without its scope cannot be interpreted.
- Attach the export to the incident rather than describing it in prose; the sequence is the evidence.
- Retention on the appliance is under your control, but exported evidence outlives any retention change.