Build an Incident Timeline from Mixed Evidence
Reconstruct a business-email-compromise attempt from five messy, contradictory evidence sources — the core analyst skill of sequencing what actually happened, in what order, in one timezone.
Estimated time
60–90 minutes
Required tools
- A spreadsheet or text editor
- Optional: a note-taking template of your choice
Skills practiced
- Evidence normalization
- Timeline construction
- Timezone handling
- Incident narration
Scenario
Harbor & Pine Outfitters (a fictional outdoor-equipment retailer, ~80 staff) uses Microsoft 365. On a Thursday afternoon, the finance manager calls IT: a vendor says the banking details on this month’s invoice look wrong, and she never sent the “updated remittance” email the vendor is referencing.
You are the IT administrator wearing the responder hat. Five fragments of evidence have been collected below. Your job is not to fix anything yet — it is to establish what happened, in what order, because every response decision depends on that sequence.
All names, addresses, and data below are invented for this exercise.
Objectives
- Normalize timestamps from mixed formats and timezones into a single reference timeline (use UTC).
- Distinguish observed facts from inferences, and label each.
- Identify the initial access moment, persistence mechanism, and action on objective.
- Produce a defensible one-page timeline a manager or insurer could read.
Evidence
E1 — Helpdesk ticket (local time, US Eastern, UTC−4):
#4482 · Thu 10:12 AM · From: dana.reyes@ (Finance Mgr) “Vendor called about a payment-change email ‘we’ sent. I did NOT send this. Also I got a weird ‘password expiring’ email Monday but ignored it. I think. Might have clicked it on my phone.”
E2 — Sign-in log excerpt (UTC), account dana.reyes:
| Time (UTC) | Result | IP geolocation | Client |
|---|---|---|---|
| Mon 14:03 | Success | Home ISP, usual city | Outlook mobile |
| Mon 14:41 | Success | Hosting provider, foreign country | Browser |
| Mon 14:44 | Success | Same hosting provider | IMAP |
| Thu 13:22 | Success | Home ISP, usual city | Outlook mobile |
E3 — Email security gateway record (UTC):
Mon 13:58 · Delivered · To: dana.reyes · Subject: “Action Required: Password Expiry Notice” · Sender domain registered 9 days ago · URL rewritten, clicked Mon 14:02 from mobile user-agent.
E4 — Mailbox audit excerpt (UTC), account dana.reyes:
Mon 14:47 · New-InboxRule · Name: ”.” · Conditions: from contains “vendor-invoices@” · Actions: MoveToFolder “RSS Subscriptions”, MarkAsRead
E5 — Vendor’s forwarded email (header summary, vendor’s local time, UTC+1):
Received Wed 16:20 · From: dana.reyes@ (authenticated, passed SPF/DKIM for the real domain) · Subject: “Updated remittance details — effective immediately” · Reply-To:
dana.reyes@harborandplne-outfitters.com(note spelling)
Tasks
- Convert every timestamp to UTC and build a single ordered timeline. Watch E1 and E5 — they are not in UTC.
- For each event, record: source, time (UTC), fact observed, and your confidence (confirmed / probable / assumed).
- Answer in writing:
- When did initial access most likely occur, and via what?
- What persistence or evasion mechanism exists, and what does it accomplish?
- Was the fraudulent email sent from the real mailbox or a lookalike domain? What is your evidence? (Look closely at E5 — there are two distinct things going on.)
- What evidence is missing that you would request next?
- Write the one-page incident narrative: five to eight sentences, facts first, inferences labeled.
Expected deliverables
- A normalized UTC timeline table (8–12 rows)
- Written answers to the four analysis questions
- A one-page plain-language incident narrative
Reflection questions
- Which single evidence source changed your interpretation the most, and why?
- What logging, had it existed, would have collapsed your uncertainty fastest?
- The user “might have clicked” — how did you handle testimony that conflicts with logs?
- At what point in your timeline should containment (session revocation, password reset, rule deletion) have been triggered if this were live?
Optional advanced challenge
Draft the customer/vendor notification email Harbor & Pine should send about the lookalike domain, and list the three containment actions you would take in the first hour — in order, with the reason each is sequenced where it is. Then compare your actions against the phases of the incident response checklist.
Defensive and ethical use
This exercise uses entirely fictional data to build defensive analysis skills. Apply these techniques only to systems and data you are authorized to examine. Nothing here provides or condones methods for gaining unauthorized access.