Two clocks, one VPN address
A payroll file was copied from a VPN address that two people held that morning. The file server logs local time and the VPN logs UTC. Line them up before naming anyone.
Briefing
HR noticed that payroll-2026-03.xlsx was copied off the file server. The audit log names only a client IP, 10.8.0.14, from the VPN pool.
The VPN hands the same address to different people over a day. The file server and the VPN concentrator also disagree about time zones. Read both headers before you compare times.
ir-ws · Incident timelines
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.