Incident Timeline Evidence Builder

Reconstructing a clear sequence of events after a cyber, safety, or operational incident is difficult when data is scattered across disparate logs, chats, and witness reports. Inconsistent timezones and missing evidence often lead to unreliable chronologies and flawed root-cause analysis.

This skill transforms fragmented records into a defensible, evidence-linked incident chronology for investigators and auditors. It prioritizes provenance, ensuring every event traces back to a specific source while explicitly flagging contradictions, clock drift, and data gaps.

What it does

• Builds source catalogues by registering unique evidence IDs, types, and integrity status for every artifact.
• Normalizes timestamps across different timezones and formats while preserving original strings to prevent conversion errors.
• Maps evidence-linked chronologies that distinguish between system-observed actions, communications, and witness recollections.
• Identifies contradictions between competing accounts or differing log clocks without forcing a resolution.
• Generates preservation requests by identifying missing originals and high-priority artifacts needed for a complete record.

How it works

1. Define scope by establishing the incident window and documenting supplied materials.
2. Extract event candidates from logs, tickets, and messages while maintaining verbatim accuracy and source references.
3. Analyze and merge records to create a unified timeline that highlights gaps, overlaps, and uncertainty intervals.
4. Deliver a neutral pack containing the event register, source index, and a strictly evidence-based narrative.

Frameworks & tools

Works with raw event logs, CSV exports, email headers, ticket histories (Jira/ServiceNow), chat transcripts (Slack/Teams), and witness statements.

Why this beats prompting it yourself

Generic prompts often hallucinate connections or silently normalize timezones by assumption, which destroys evidentiary value. This skill uses a structured investigative framework that preserves uncertainty and separates analyst inference from documented fact.

Use cases

• Post-incident reviews to build a neutral sequence of events for stakeholder reporting.
• Cyber-forensic preparation by organizing raw logs before handing them to a specialist team.
• Audit response to demonstrate a clear trail of actions taken during a service outage.
• Workplace investigations by merging conflicting witness accounts with digital activity logs.

Known limitations

Does not independently authenticate evidence or determine legal liability. It cannot acquire private records automatically and requires user-supplied artifacts.