What is the role of a timeline in incident response?

• A. To encrypt all events.
• B. To visually display the root cause by mapping a single event.
• C. To replace log analysis entirely.
• D. To sequence events across sources for correlation and analysis.

Answer: (D)

Sequencing events across sources for correlation and analysis is the main purpose of a timeline in incident response. By pulling data from endpoints, network devices, and security tools and aligning them by timestamp, you can see how activity progressed and how different events relate to one another. This lets you reconstruct the attack chain, identify the root cause, and determine dwell time, containment points, and remediation steps. The timeline supports validating hypotheses and coordinating actions across teams because it weaves together multiple data streams into a coherent narrative. It doesn’t encrypt events, and it isn’t meant to replace log analysis; rather, it relies on logs and telemetry to tell the full story. It also isn’t about focusing on a single event—the value comes from the sequence and relationships across sources.