<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-incident-timeline-reconstruction
description: >-
  Reconstruct incident timelines by correlating events across SIEM logs, EDR telemetry, network captures, and authentication records.
domain: cybersecurity
subdomain: incident-management
tags:
  - timeline
  - log-correlation
  - forensics
  - evidence
  - reconstruction
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0001", "TA0002", "TA0003", "TA0005", "TA0010"]
  nist-csf: ["RS.AN-1", "RS.AN-2", "RS.AN-3"]
  frameworks: ["NIST SP 800-61", "NIST SP 800-86"]
---

# Performing Incident Timeline Reconstruction

## Overview

Timeline reconstruction establishes the chronological sequence of attacker
actions, system events, and defensive responses during an incident. Essential
for root cause analysis, scope determination, and regulatory reporting.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM access (Splunk/Elastic/Sentinel) | Centralized log search |
| EDR console (CrowdStrike/Defender) | Endpoint telemetry |
| Network logs (firewall/proxy/DNS) | Network events |
| Authentication logs (AD/Okta) | Access timeline |

## Process

```
PHASE 1: Establish Pivot Points
├── Known IOCs (IPs, hashes, domains, usernames)
├── Alert timestamps (first detection)
└── Known good baseline (last verified clean)

PHASE 2: Expand Outward
├── Search 48hr before first IOC
├── Correlate across log sources
└── Map lateral movement and exfiltration

PHASE 3: Verify and Order
├── Normalize all timestamps to UTC
├── Resolve clock skew between sources
└── Assign confidence levels

PHASE 4: Visualize and Report
├── Chronological event table
└── Swimlane diagram (attacker | systems | defenders)
```

## SIEM Queries

```spl
index=* (user="compromised_user" OR src_user="compromised_user")
| where _time >= relative_time(now(), "-24h@h")
| table _time, index, sourcetype, src_ip, dest, action
| sort _time
```

```kql
let user = "admin@contoso.com";
union (SigninLogs | where UserPrincipalName == user),
      (SecurityAlert | where Entities contains user)
| sort by TimeGenerated asc
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] All timestamps normalized to UTC
- [ ] Clock skew documented between sources
- [ ] Events cross-referenced across 2+ sources
- [ ] Confidence levels assigned
- [ ] Timeline covers initial access to containment
