Build a timeline from five sources and write the finding

short · 50 min · Objective 4.9

Task

Correlate five log sources into one timeline for a single incident, then write the finding in the form somebody can act on — separating what you observed from what you inferred.

Steps

  1. Generate five synthetic logs describing one incident: a mail gateway log, a web proxy log, an endpoint process log, a Windows-style authentication log, and a firewall log. Use a script so the true sequence is known to you.
  2. Include the joins deliberately: a username linking the auth and proxy logs, an address linking the firewall and proxy logs, and a DHCP lease record linking the address to a hostname.
  3. Normalise every timestamp to UTC and merge into /tmp/timeline.csv as utc_time,source,event,actor,detail.
  4. Read the timeline and identify the initial access, the execution, the command and control, and the lateral movement.
  5. Write /tmp/finding.md with the structure from the lesson: one sentence at the top, the timeline, the scope, what you checked and found CLEAN, your confidence, and the actions required with owners.
  6. Mark every line of your conclusion as either OBSERVED or INFERRED.

Verify

awk -F, 'NR>1 {print $2}' /tmp/timeline.csv | sort -u | wc -l
python3 - <<'PY'
import csv
rows=list(csv.DictReader(open('/tmp/timeline.csv')))
srcs={r['source'] for r in rows}
assert len(srcs)>=5, 'fewer than five sources: '+str(sorted(srcs))
times=[r['utc_time'] for r in rows]
assert times==sorted(times), 'the timeline is not in chronological order'
print('%d events from %d sources, in order' % (len(rows),len(srcs)))
t=open('/tmp/finding.md').read().upper()
for word in ('OBSERVED','INFERRED'):
    assert word in t, 'the finding does not mark what was '+word.lower()
print('observations and inferences are distinguished')
PY
grep -ciE "checked|clean|no evidence" /tmp/finding.md

The assertions require five genuine sources, chronological order, and a finding that distinguishes observation from inference. The last grep matters too: a finding that says what you checked and found clean is far more useful than one that is silent about it, because silence reads as 'not looked at'.

Notes

The DHCP lease is the join most investigations are missing. A firewall log gives you an address, the address belonged to three different machines that week, and without the lease record the timeline attaches the activity to whoever happens to hold it now — which is how an investigation ends up at the wrong person with complete confidence.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.