> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/07-security-investigation-basics/build-investigation-timeline.md).

# Build a Simple Investigation Timeline

## Objective

Combine multiple events into a short timeline so that activity can be understood in sequence.

## Why Timelines Matter

Security events become easier to understand when they are placed in chronological order.

A timeline can reveal what happened first, what followed, and whether separate events are part of the same activity.

## Suggested Lab Scenario

Use events from one of the previous exercises, such as:

* failed logons followed by a successful sign-in
* failed logons followed by an account lockout
* user creation followed by a group membership change
* process creation followed by a network connection

## Collect the Evidence

For each relevant event, record:

* timestamp
* system
* event source
* event ID
* user
* short description

## Example Timeline

| Time     | System   | Source   | Event ID | Activity                            |
| -------- | -------- | -------- | -------- | ----------------------------------- |
| 10:02:10 | CLIENT01 | Security | 4625     | Failed logon for labuser01          |
| 10:02:18 | CLIENT01 | Security | 4625     | Second failed logon                 |
| 10:02:31 | CLIENT01 | Security | 4624     | Successful logon                    |
| 10:03:05 | CLIENT01 | Sysmon   | 1        | Command Prompt started              |
| 10:03:12 | CLIENT01 | Sysmon   | 1        | Notepad started from Command Prompt |

Use your actual lab timestamps rather than copying the example.

## Analyze the Sequence

Ask:

1. What happened first?
2. Which events are directly related?
3. Which user and host appear repeatedly?
4. Is there a clear explanation for the sequence?
5. Are there gaps that require more evidence?

## Write a Short Conclusion

A useful conclusion should be brief and evidence-based.

Example:

```
The activity began with two failed logons for labuser01 on CLIENT01.
A successful sign-in followed using the same account.
Shortly afterward, Command Prompt launched Notepad as part of the planned lab exercise.
The sequence matched expected test activity and no unexplained events were identified.
```

## Security Relevance

A timeline helps transform individual log entries into a coherent story.

This is a core investigation skill because alerts often provide only one starting event while the surrounding evidence explains the real activity.