The Causal Timeline

What is it?

A causal timeline is the correlated events placed in true, clock-corrected order, where you have tested that each step could actually cause the next — not just that it happened afterward. It turns a set of matches into a defensible narrative.

Why it matters

'After this, therefore because of this' is the most common analytic error. Two events in a row are not a cause-and-effect unless one can produce the other. A senior analyst reconstructs sequence correctly (clock skew corrected) and then tests causality before claiming a chain.

Where you see it

In a timeline view where each row carries its source and a normalised UTC time, and in process-tree tools where parent→child edges are literal causal links you can trust more than timestamps alone.

What normal looks like

Legitimate sequences have benign causes for each edge: a login causes a profile load; a scheduled task causes a script run. The parent of each action is expected and signed.

What suspicious looks like

A chain where the causal edges are attacker-shaped: a document process is the parent of a shell, that shell is the parent of an outbound connection, and the timing is tight enough that each plausibly launched the next.

How analysts investigate

Normalise every timestamp to one clock, order the events, then for each adjacent pair ask 'could the first actually cause the second?'. Prefer structural links (process parent/child) over mere time-adjacency, and flag any edge you had to assume.

Common beginner mistakes

Reading timestamps from different sources without correcting clock skew, so the order — and the causality — is wrong.
Assuming 'B came after A, so A caused B' when A had no ability to produce B.

Sequence first, then causality

  time (UTC, clock-corrected) ─────────────────────────────────▶
  02:20  winword.exe ──(parent)──▶ powershell.exe   [structural: strong]
  02:20  powershell.exe ──(parent)──▶ net use \\FS-02  [structural: strong]
  02:53  proxy POST 4GB from WS-19                    [time-adjacent: test it]
  causal chain holds only where an edge is structural OR independently explained

Parent→child process edges are causal; a merely time-adjacent event must be tested before you add it to the chain.

Worked example. Endpoint shows winword.exe as the parent of powershell.exe, and powershell.exe as the parent of a share-mount — two structural (parent/child) edges you can trust. The 02:53 proxy upload is only time-adjacent: it happened after, but nothing structurally links it. To add it to the causal chain you must corroborate — e.g. the same PowerShell process id opened the socket, or the archive it built matches the upload size. Without that link, it stays a strong lead, not a proven step.

Quick check

Two events: (1) a firewall allow to 203.0.113.44 at 02:52, (2) a PowerShell process on WS-19 at 02:53. Which reasoning is sound?

A quick self-check — it doesn't affect your XP or progress.