Building a timeline of a cyber security incident is one of the most critical parts of affective incident investigation and response. It is essential in order to understand the path of the attack, its...
Updated Nov 03, 2021
Version 2.0
Blog Post
I think this Timeline function is a really good addition to the ticketing system in Sentinel. This is something I wanted to see in other ticketing systems in the past but it is rarely there.
However, there is a behavior that is odd to me and I think it is not completely logical. When I add a new bookmark to an incident then it is placed onto the Timeline at the time of the Bookmark creation.
So lets say there is an event happening at 1PM. Then an incident is created independently at 2PM. As I start to investigate the incident, I find the the event from 1PM and I realize it is related to the incident, so I bookmark it (at 3 PM) and then I attach the bookmark to the incident (little bit later). In this case the Bookmark on the timeline is going to be shown as an event after the incident creation (3PM vs 2PM). On the other hand, the event I bookmarked actually happened at 1PM, so earlier than the incident was created.
From an IR point of view, seeing the time of the event rather than the time of the bookmark creation seems more logical.
What do you think of this? Is it possible to change these times, or to use another time information from the event, since the original event time is also there in the bookmark event (I guess this depends on the query)?