Timeline: Correlating an Incident to a Verdict

What is it?

Timeline is Elastic Security's investigation canvas: you drag in events from any source, filter them, and order them by time around a shared key (host.name, user.name) to build one correlated sequence — the Elastic equivalent of the multi-source Splunk correlation.

Why it matters

No single alert proves an intrusion; the chain across sources does — and the tool changes, the reasoning does not. Building the timeline is what turns a scattered set of alerts into a defensible incident narrative you can hand up.

Where you see it

Add user.name:j.rai and pull auth, endpoint and proxy events onto the Timeline: foreign login → lsass access on FIN-07 → 240MB upload to a new domain, in order, minutes apart — one story from three sources.

What normal looks like

A benign timeline whose events each have an innocent neighbour — a login, expected app traffic, a known scheduled task — with no causal chain toward harm.

What suspicious looks like

A causal chain no benign story explains — access, then credential theft, then exfiltration — tied to one identity within minutes, with no change ticket. Correlation, not any single event, is the tell.

How analysts investigate

Pick the shared key, pull the relevant sources onto the Timeline, order by time, read the sequence for cause and effect, and test whether a benign explanation fits the WHOLE chain before reaching a verdict.

Common beginner mistakes

Correlating on time alone and mixing two users' events into one false story.
Escalating a single scary event without the timeline — or missing the benign explanation for the whole chain.

One key, ordered by time, across sources

  Timeline — key = user.name:j.rai, ordered by @timestamp
  02:14  auth   login success   source.ip 185.220.101.9 (Tor)   ← initial access
  02:15  edr    rundll32 → lsass   host.name FIN-07              ← credential access
  02:17  proxy  upload 240MB    destination new domain           ← exfiltration
  no change ticket · same user · 3 minutes → a defensible incident
  (identical reasoning to the Splunk correlation — the tool changed, not the method)

Timeline correlates events on a shared key and time into one defensible narrative — the same method as Splunk.

Quick check

Which conclusion, built on the Timeline, is defensible enough to escalate?

A quick self-check — it doesn't affect your XP or progress.