Chapter 9 — Investigation and timelines
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Why timelines"]
N2["Lab — merging sources"]
N3["9.2 Lab result"]
N4["9.3 Facts and inferences"]
N5["9.4 Scope"]
N6["9.5 Evidence"]
N7["9.6 Research"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Why timelines"]
N2["Lab — merging sources"]
N3["9.2 Lab result"]
N4["9.3 Facts and inferences"]
N5["9.4 Scope"]
N6["9.5 Evidence"]
N7["9.6 Research"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Why timelines]
|
v
[Lab — merging sources]
|
v
[9.2 Lab result]
|
v
[9.3 Facts and inferences]
|
v
[9.4 Scope]
|
v
[9.5 Evidence]
|
v
[9.6 Research]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) build a cross-source timeline; (2) separate facts from inferences; (3) scope an incident; (4) preserve evidence for later review.
9.1 Why timelines
A timeline puts events from different sources in one order, so gaps and causes become visible. It is the core of most investigations. For March, the timeline joined VPN logs, domain controller logs, file-server audit logs and firewall logs, which no single system held. Placed in order, they showed the login, the admin change, the file reads, the data leaving and the attempt to hide the change. Without a shared time source, events from different systems could not have been ordered reliably.
Lab — merging sources
"""Merge synthetic events from three sources into one timeline."""
vpn = [("2026-03-03 22:41", "VPN", "login j.harper from 198.51.100.23 (new country)")]
dc = [("2026-03-03 22:43", "DC", "j.harper added to Domain Admins (by j.harper, who holds group-management rights)"),
("2026-03-03 22:58", "DC", "j.harper removed from Domain Admins")]
fs = [("2026-03-03 22:47", "FILE1", "j.harper read 2,310 files in \\\\FILE1\\Designs"),
("2026-03-03 22:55", "FILE1", "j.harper read 0 files; session closed")]
for t, src, msg in sorted(vpn + dc + fs):
print(t[11:], f"{src:5}", msg)
Run with python3 lab_timeline.py. Verified output:
22:41 VPN login j.harper from 198.51.100.23 (new country)
22:43 DC j.harper added to Domain Admins (by j.harper, who holds group-management rights)
22:47 FILE1 j.harper read 2,310 files in \\FILE1\Designs
22:55 FILE1 j.harper read 0 files; session closed
22:58 DC j.harper removed from Domain Admins
9.2 Lab result
The merged March timeline: 22:41 VPN login from 198.51.100.23 (new country); 22:43 j.harper added to Domain Admins; 22:47 2,310 files read in the Designs share; 22:55 session closed; 22:58 j.harper removed from Domain Admins. The removal suggests an attempt to hide the change. The timeline shows how quickly the attack moved: from login to data reading took six minutes, and the whole event lasted seventeen. Priya notes which events are facts from logs and which are her interpretation, such as the reason for the removal.
9.3 Facts and inferences
Facts: the events above. Inference: someone other than j.harper used his account, since he was at home in the UK and his laptop showed no VPN session. Priya labels each line as fact or inference in the report. Labelling each line helps readers see where the report's conclusions come from, and which could change if new evidence appears. The inference about j.harper rests on two facts that could be checked: his location and his laptop's VPN status. Priya does not claim to know who the attacker was, only that someone other than j.harper used the account.
9.4 Scope
Questions: how did the attacker get the password? Was MFA bypassed? Were files copied out? Email logs show j.harper entered his password on a fake VPN page two days earlier; the VPN lacked MFA; firewall logs show 1.4 GB sent to 198.51.100.23 between 22:47 and 22:55. Each question changes the response: a phished password calls for MFA and staff awareness, missing MFA calls for adding it to the VPN, and data sent out calls for checking customer contracts. The answers set the scope of the incident, and the final scope statement found no evidence of other accounts or malware. Priya records which sources answered each question, so the conclusions can be checked.
9.5 Evidence
Copies of logs are saved with time stamps and hashes, and originals stay in the SIEM. A record lists who handled each item. Hashes show that saved copies have not changed since they were made, which matters if the evidence is later needed for an insurer or legal action. Keeping originals in the SIEM means the copies can be checked against them. The handling record lists each item, who copied it, when and where it was stored. Priya follows the same steps for every incident, so evidence is handled consistently.
9.6 Research
Hassan et al. (2019) showed that provenance (how events connect) helps reduce false alarms and speeds investigation; the same idea underlies good timelines. The research applies to Fenwick's investigation in a simple form: linking the VPN login to the admin change and the file reads through the same account and address showed one connected event, not three separate alerts. Priya uses this idea to explain to Tom why connecting events matters more than looking at each alert alone. Tom writes this into the compromised-account runbook, which now tells the analyst to search for other events from the same account and address before closing an alert.
Gaps stated
The report states that ERP logs were not collected in March.
Worked example
The final scope statement: one account compromised by phishing; Domain Admins rights used for 15 minutes; about 1.4 GB of design files sent out; no evidence of other accounts or malware. Actions: MFA on VPN, review of who can change admin groups, customer notification check by legal.
Synthetic case. Events and volumes are synthetic.
Errors and limits
Missing logs (for example from the ERP server in March) can hide parts of the story; state such gaps.
Exercises
- EX041 — Timeline order. Give the first three timeline events. Rubric: 3 = 22:41 VPN; 22:43 admin add; 22:47 files read; 2 = partial; 1 = one; 0 = none.
- EX042 — Removal meaning. What might the 22:58 removal suggest? Rubric: 3 = attempt to hide the change; 2 = partial; 1 = vague; 0 = none.
- EX043 — Fact vs inference. Give one fact and one inference. Rubric: 3 = fact: events; inference: not j.harper; 2 = partial; 1 = vague; 0 = none.
- EX044 — Root cause. How was the password obtained? Rubric: 3 = fake VPN page phishing two days before; no MFA; 2 = partial; 1 = vague; 0 = none.
- EX045 — Scope statement. Summarise the scope statement. Rubric: 3 = one account; 15 min admin; 1.4 GB out; no other accounts/malware; 2 = partial; 1 = one; 0 = none.
Synthesis
Merge sources, separate fact from inference and state scope and gaps clearly.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →