CYBRARY Unit 2 — Attacker steps
12 minTurning steps into a timeline
A breach timeline is the attacker's steps and your detections on one clock.
By the end you can
- Build a timeline with both the attacker's actions and your detections on it.
- Spot the gaps where a step happened and nothing fired.
- Use the gaps as the detection backlog.
One clock, two rows
Put what the attacker did on one row and what you saw on another, sharing a clock. The distance between a step and the detection that caught it is your dwell time for that step. A step with nothing underneath it is a blind spot you now have written down.
- Every timeline entry names a machine, an account and a source you can reopen.
- 'Found by hand' is a legitimate entry — and it is also a detection to write.
- Times come from the records, not from memory.
Check yourself
A step in the timeline has no detection beneath it. What is that?