Mail, proxy, and EDR on one timeline

Three exports from one phishing case all start with an ISO timestamp. Merge them with sort and read the click, the download, the process, and the first beacon in order.

Terminal mission
Beginner
4 objectives
0 of 4 solved

Briefing

A user reported a strange invoice after already opening it. You have exports from the mail gateway, the web proxy, and the endpoint agent.

Each tool shows a slice. When every line starts with an ISO 8601 UTC timestamp, sort puts the slices back together in the order things happened.

analyst@ir-ws

ir-ws · Incident timelines

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@ir-ws:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.