What are 'artifact timelines' and how do they support containment decisions?

• A. Sequenced event records from artifacts to reconstruct the attack; helps determine dwell time and containment needs
• B. Snapshots of the network at a single moment
• C. A list of files accessed in order of size
• D. A timeline of malware signing dates

Answer: (A)

Artifact timelines stitch together evidence from multiple artifacts into a chronological narrative of what happened. By lining up events from logs, registry changes, file system metadata, network artifacts, and other sourcing, you can see the exact order of attacker actions, when the intrusion began, how long it persisted, and which systems were touched. This timing is crucial for containment decisions: it reveals dwell time before detection, shows paths of lateral movement, and identifies the specific hosts and credentials involved, guiding targeted isolation, credential rotation, and cleanup efforts. A static snapshot captures only a moment in time, a list ordered by file size doesn’t reflect sequence, and a timeline of signing dates doesn’t convey the attack’s progression. Using artifact timelines thus provides the context needed to contain and eradicate the incident efficiently.