Question 1

Why is timeline reconstruction important in incident response?

Accepted Answer

Building an accurate timeline is critical for understanding the full scope of an attack — what the attacker accessed, how they moved laterally, and what data may have been compromised. It helps identify the initial entry point, determine which systems need remediation, supports forensic and legal proceedings, and informs improvements to prevent similar incidents in the future.

Question 2

What are common phases of a cyberattack timeline?

Accepted Answer

Most attacks follow a pattern: initial access (phishing email, exploited vulnerability), establishing persistence (backdoor, scheduled task), privilege escalation (exploiting misconfigurations), lateral movement (accessing other systems), data collection and exfiltration, and finally impact (ransomware deployment, data destruction). Understanding this kill chain helps defenders detect attacks at each stage.

Incident Timeline

How to play

Frequently Asked Questions