Glossary: Security Operations and Incident Response

Timeline

Also written: forensic timeline

The events of an incident in time order (first email, first click, first suspicious process, first connection out), built from the logs and evidence. It shows what happened, gives the date for choosing a clean backup, and supplies the report's metrics.