Need more information on the serialize command

[Gary Bushey]

I am using the serialize command, and having it show the row number, but I don't understand how it determines which row gets the row number.  The command I am using below

SecurityIncident
| where ProviderIncidentId == 283
| serialize rn=row_number()
| extend RowNumber= rn
| order by rn asc

Returns the following order

Which doesn't make sense to me.  I would have thought the row order would be based on TimeGenerated but it does not appear that is the case.   Can anyone tell me how it determines the row order?

[#2]

After more reading and playing around, I figured out that it is up to me to order the list BEFORE I serialize it.  The serialize command just takes the rows in the order they were presented by the query.