Build an incident timeline from recorded events

A timeline should preserve timestamps and distinguish observation from later interpretation. Align timezones before drawing conclusions about event order.

Bound the operating task

Provide the relevant records and define what is a draft recommendation versus an approved action. Keep original records intact and ask for an output manifest so you can find the result. Start with file generation and human review before adding any external action through a connected tool. A useful operations deliverable should make exceptions and missing information visible.

Inputs for this workflow: Sanitized logs, incident notes and known timezone information.

Work through the task

1. Normalize times while preserving originals.
2. Link each event to its source.

A brief you can adapt

Write timeline.csv with original timestamp, normalized timestamp, event, source and uncertainty. Put proposed causes in a separate note.

The filenames above are examples. Replace them with your actual inputs and destination before submitting the task.

Review the deliverable

Check events near timezone boundaries and confirm that inferred timestamps are labeled.

Where this approach can fail

Temporal proximity does not prove causation, and missing logs do not prove an event did not happen.

For the related desktop setup, see review results.