Build visual timelines for security incidents. Add events with timestamps, categories, and evidence references.
Incident Timeline Builder organizes security incident observations as timestamped events on a visual chronology. Each event can carry a category and an evidence reference, allowing an analyst to distinguish event types while retaining a pointer to the supporting artifact. Because incident records may be sensitive, entries remain in the browser and are not uploaded. The important limitation is that placement on the timeline does not prove a timestamp is correct. Conflicting clocks, missing time zones, inferred times, and later corrections still require investigative judgment.
Enter each observed action or finding as a separate event and pair its description with a timestamp. Add a category to distinguish activities such as authentication, endpoint detection, network traffic, containment, or communications. An evidence reference can identify the supporting log entry, alert, message, ticket, screenshot, or case artifact. The builder presents these structured records as a timeline without determining whether the evidence is accurate.
Use the visual positions of events to inspect their order, proximity, gaps, and clusters across the incident. Category labels help separate different kinds of activity, while evidence references provide a route back to source material. When records conflict, preserve that disagreement in separate events or in their descriptions instead of replacing uncertain evidence with a single guessed timestamp.
Only when each timestamp retains enough information to identify its offset from UTC. Prefer unambiguous timestamps containing a numeric UTC offset, such as 2026-08-15T14:32:00-04:00, or a Z suffix for UTC. A zone abbreviation such as EST can be ambiguous, and a bare local time cannot establish a reliable order across systems.
No. An evidence reference can help a reviewer find the log record, message, alert, disk image, or ticket supporting an event, but the timeline does not establish provenance or chain of custody. Preserve originals and record acquisition, handling, integrity checks, and access in the case's evidence process. Use the builder as an index and chronology.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.