Timeline Reconstruction
IT IT Ops
The prompt
Build chronological incident timeline from logs. Normalize timestamps, identify first malicious action, map lateral movement.
Why this works
Timestamp normalization prevents timeline errors; evidence tagging maintains forensic integrity.
Risks & review
Log gaps create inferred events; mark confidence. Timezone conversion errors distort timeline.