How to Create an Incident Timeline After a Cyberattack

A timeline helps responders understand the sequence of events and distinguish confirmed facts from assumptions. Build it from preserved records, not memory alone.

Use a consistent time standard

Record timestamps with their time zones and note any conversion to a common reference such as UTC. System clocks can be wrong or drift, so record known clock issues.

Collect relevant sources

Depending on the incident, sources may include identity-provider alerts, server logs, cloud audit events, email notifications, endpoint alerts, payment records, and user observations.

Separate facts from interpretation

For each entry, record the observed event, source, confidence, and any uncertainty. Label hypotheses clearly rather than treating them as confirmed events.

Record response actions too

Include credential resets, account lockouts, isolation, provider notifications, configuration changes, and restoration steps. These actions can affect what later logs show.

Preserve the original evidence

Keep source logs and exports intact where possible, note who collected them and when, and work from copies for analysis. Follow applicable retention and privacy rules.

Use the timeline to guide priorities

Identify unanswered questions, likely exposure windows, and immediate containment needs. Update the timeline as new evidence emerges and retain prior versions when practical.

Important: General educational information, not legal or financial advice. Outcomes depend on the facts and applicable law; no recovery or security result is guaranteed.