Lesson 8 of 12 · Investigation
Building the attack timeline
Objective
Gather every trace (disk, logs, network, cloud) into a single time-ordered frieze, to tell the attack end to end: how the attacker got in, what they did, in what order, and where they could have been stopped.
This lesson is part of the full course
Unlock Linux Incident Response and Digital Forensics to read every lesson, do the exercises, access the simulations and earn your certificate.
Already enrolled? Log in.