Incident timeline evidence

Detects incident timelines: timeline or chronology wording with timestamped entries and host, user or evidence-source artefacts. Timeline wording alone is discovery-only.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a timestamped entry (ISO or d/m/yyyy hh:mm) or a host/user artefact (IPv4, internal hostname, labelled host/user/account/evidence source)), and 85 needs two distinct structures plus independent attack-phase (initial access, lateral movement, exfiltration, containment) evidence, so policies, blank forms and training text stay below 75.

Detection quality

Topic verified

Jurisdictions

global

Regulations

Privacy Act 1988 (Cth), NDB Scheme (Cth), Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

ISO 27001, NIST CSF

Data categories

security

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:incident\s+timeline|timeline\s+of\s+(?:events|the\s+incident|compromise)|attack\s+timeline|chronology\s+of\s+(?:events|the\s+incident)|event\s+timeline)\b

Corroborative evidence keywords

initial access, lateral movement, exfiltration, containment, eradication, first observed, privilege escalation, ransomware, phishing email, persistence

Proximity: 300 characters

Should match

• The incident timeline will be finalised after the forensic review. — Discovery probe (65)
• Incident timeline 2026-09-12 03:14 first alert raised by the mail gateway — Medium-tier probe (75) - one timestamped entry
• Incident timeline - INC-2026-114 2026-09-12 03:14 phishing email delivered to avery.teston (initial access) 2026-09-12 03:41 macro executed on ws-fin-114.harbour.internal 2026-09-12 05:02 lateral movement to 10.20.4.31 using a stolen service account 2026-09-12 07:15 containment - hosts isolated. — High-tier probe (85) - multiple timestamps, host artefacts, attack phases

Should not match

• unrelated generic text — No relevant phrase context
• placeholder value 12345 — Random text should not match
• Policy statement: the incident manager maintains an incident timeline for every major incident. — Policy text
• Incident timeline template Date/time: ________ Host: [insert] Action: ________ — Blank template
• News report: the company published a timeline of events showing attackers moved laterally on 12/09/2026 03:14 before containment. — News framing

Known false positives

• Project plans and history articles contain dated timelines. Mitigation: Enforcement needs incident/timeline wording plus timestamps and host/user artefacts; 85 also needs attack-phase context; guidance/news framing is excluded.

References

• Information Security Manual (ISM)
• Security of Critical Infrastructure Act 2018 (Cth)
• Data breach preparation and response (OAIC)
• APRA CPS 234 Information Security
• NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• Privacy Act 1988 (Cth)