<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-incident-timeline
description: >-
  Constructs unified incident timelines from multiple log sources using Plaso,
  Hayabusa, and manual correlation to establish attack sequence and dwell time.
domain: cybersecurity
subdomain: incident-response
tags:
  - timeline-analysis
  - plaso
  - hayabusa
  - log-correlation
  - attack-sequence
  - dwell-time
version: '1.0'
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Incident Timelines

## Overview

Timeline reconstruction is the backbone of incident investigation — it answers
when each attack phase occurred, how the attacker moved, and what the dwell time
was. A unified timeline correlates events from EVTX logs, syslog, web server
logs, EDR telemetry, firewall logs, and filesystem metadata into a single
chronologically ordered sequence normalized to UTC.

Without a timeline, IR is guesswork. With one, you see the full attack narrative.

## Prerequisites

| Tool | Purpose | Install |
|------|---------|---------|
| Plaso (log2timeline) | Multi-source super-timeline | `pip install plaso` |
| Hayabusa | EVTX timeline generator | GitHub release binary |
| Chainsaw | Sigma-based EVTX hunting | GitHub release binary |
| MFTECmd | MFT/NTFS timeline | Eric Zimmerman tools |
| jq | JSON processing | Package manager |
| csvkit | CSV manipulation | `pip install csvkit` |

## Key Concepts

### Timeline Data Sources

| Source | Key Events | Tool |
|--------|-----------|------|
| Windows EVTX | Logon, process creation, service install | Hayabusa, Chainsaw |
| Linux syslog | Auth, cron, kernel messages | Plaso |
| MFT ($MFT) | File creation/modification/access | MFTECmd |
| Prefetch | Program execution history | PECmd |
| Web server logs | Request timestamps, IPs | Plaso |
| Firewall logs | Connection allow/deny | Plaso, custom |
| EDR telemetry | Process, network, file events | API export |

### Timestamp Normalization

All timestamps must be normalized to UTC before correlation:

```bash
# Convert local time to UTC
date -u -d "2026-03-15 14:30:00 EST" +"%Y-%m-%dT%H:%M:%SZ"
```

### Timeline Pivots

Key events to anchor the timeline around:
- **Initial access** — first known malicious activity
- **Persistence installation** — scheduled tasks, services, registry
- **Lateral movement** — remote logons, SMB, WMI, PsExec
- **Data staging** — compression, encryption of target data
- **Exfiltration** — outbound transfers to attacker infrastructure
- **Actions on objectives** — ransomware deployment, data destruction

## Workflow

### Step 1 — Collect Log Sources

```bash
# Export Windows EVTX logs
mkdir -p /evidence/logs/evtx
wevtutil epl Security /evidence/logs/evtx/Security.evtx
wevtutil epl System /evidence/logs/evtx/System.evtx
wevtutil epl "Microsoft-Windows-Sysmon/Operational" /evidence/logs/evtx/Sysmon.evtx
wevtutil epl "Microsoft-Windows-PowerShell/Operational" /evidence/logs/evtx/PowerShell.evtx

# Collect Linux logs
cp /var/log/auth.log /evidence/logs/
cp /var/log/syslog /evidence/logs/
cp /var/log/apache2/access.log /evidence/logs/
```

### Step 2 — Generate EVTX Timeline with Hayabusa

```bash
# Full CSV timeline from EVTX
hayabusa csv-timeline -d /evidence/logs/evtx/ -o /evidence/timeline/hayabusa-timeline.csv

# JSON output for programmatic processing
hayabusa json-timeline -d /evidence/logs/evtx/ -o /evidence/timeline/hayabusa-timeline.jsonl

# Filter by minimum severity level
hayabusa csv-timeline -d /evidence/logs/evtx/ -o /evidence/timeline/high-alerts.csv --min-level high

# Pivot on specific time window
hayabusa csv-timeline -d /evidence/logs/evtx/ \
  --timeline-start "2026-03-10T00:00:00Z" \
  --timeline-end "2026-03-15T23:59:59Z" \
  -o /evidence/timeline/window.csv
```

### Step 3 — Generate Super-Timeline with Plaso

```bash
# Create Plaso storage from disk image
log2timeline.py /evidence/timeline/plaso.dump /evidence/disk.E01

# Create from directory of log files
log2timeline.py /evidence/timeline/plaso.dump /evidence/logs/

# Export to CSV with time slice
psort.py -o l2tcsv /evidence/timeline/plaso.dump \
  "date > '2026-03-10' AND date < '2026-03-16'" \
  -w /evidence/timeline/plaso-timeline.csv
```

### Step 4 — Parse MFT for File Timeline

```bash
# Parse $MFT to CSV
MFTECmd.exe -f /evidence/\$MFT --csv /evidence/timeline/ --csvf mft-timeline.csv

# Key columns: Created, Modified, Accessed, Entry Modified, FileName, ParentPath
# Look for files created in suspicious directories during attack window
```

### Step 5 — Correlate and Merge

```bash
# Merge Hayabusa + Plaso timelines (after normalizing column names)
# Hayabusa columns: Timestamp, RuleTitle, Level, Computer, Details
# Plaso columns: datetime, timestamp_desc, source, message

# Quick correlation: extract key events sorted by time
cat /evidence/timeline/hayabusa-timeline.csv | \
  csvgrep -c Level -m "critical\|high" | \
  csvsort -c Timestamp > /evidence/timeline/critical-events.csv

# Build attack narrative from timeline pivots
grep -iE "4624|4625|4672|4688|7045|1116" /evidence/timeline/hayabusa-timeline.csv | \
  sort -t',' -k1 > /evidence/timeline/attack-sequence.csv
```

### Step 6 — Identify Key Milestones

Document these timeline milestones:

```
INCIDENT TIMELINE
━━━━━━━━━━━━━━━━
T-0  Initial Access:     [timestamp] — [method and evidence]
T+1  Execution:          [timestamp] — [what ran and where]
T+2  Persistence:        [timestamp] — [mechanism installed]
T+3  Discovery:          [timestamp] — [enumeration commands]
T+4  Lateral Movement:   [timestamp] — [source → destination]
T+5  Collection:         [timestamp] — [data staged]
T+6  Exfiltration:       [timestamp] — [data sent to C2]
T+7  Detection:          [timestamp] — [alert that triggered IR]
Dwell Time: T+7 minus T-0
```

## Verification

- [ ] All log sources collected and preserved with hashes
- [ ] Timestamps normalized to UTC across all sources
- [ ] Hayabusa EVTX timeline generated with severity filtering
- [ ] Plaso super-timeline created from available artifacts
- [ ] MFT timeline parsed for file system events
- [ ] Key attack milestones identified and documented
- [ ] Dwell time calculated (initial access to detection)
- [ ] Timeline shared with IR team for validation

## References

- Plaso Documentation: https://plaso.readthedocs.io
- Hayabusa: https://github.com/Yamato-Security/hayabusa
- Chainsaw: https://github.com/WithSecureLabs/chainsaw
- Eric Zimmerman Tools: https://ericzimmerman.github.io
- SANS FOR508: Timeline Analysis
