My Games
Account 🔐
Sign Up
Login
Global Leaderboard
Case Vault
Badge Backpack
Blue Team Glossary
Login and start playing
Leaving so soon?
×
You really want to log out? We were having so much fun!
Home
›
Glossary
›
timeline
Timeline
Definition
A timeline is a structured record of events arranged in the order they occurred during a security investigation. Analysts build timelines to understand how an incident unfolded from beginning to end. Each entry shows what happened, when it happened, and where the activity took place. Timelines help connect individual events into a clear picture of attacker actions, their path through the environment, and the impact on systems or data. Data for a timeline usually comes from logs such as authentication events, network traffic, file changes, and process execution. Analysts review each event’s timestamp and then organize the sequence to answer key questions: * How did the attacker first gain access? * Which systems and accounts were involved? * When did privilege escalate or malware deploy? * What happened last before detection or containment? Timelines support multiple parts of incident response. They help investigators validate theories, measure how long an attacker has been active, and identify missed warning signs. They are also used to communicate findings to leadership and guide recovery actions. A well-built timeline allows defenders to understand the full scope of an intrusion and prevent similar attacks in the future.
Explore More Terms
Investigation
Remote-Services-Exploitation
Influence-Operations
Contains
Pipe