Incident Timeline Builder
Paste log snippets or add events by hand to build an incident chronology. Timestamps are normalised to a single absolute UTC line of time, so events from different logs and timezones sort correctly.
All processing is done in your browser. No data is sent to any server. A working draft is saved only in this browser (clear it any time).
How to use & how timezones are handled
- Add events. Paste raw log lines (one per line), add an event manually, or import a JSON timeline. Click Load Sample to see a worked brute-force-then-malware example.
- Read the chronology. Events are placed on one absolute timeline. The table shows each event's time (UTC), the time elapsed since the first event, and the gap from the previous event.
- Fix and annotate. Click any row or dot to edit the time, severity, phase, confidence and add investigation notes.
- Export. JSON (re-importable), CSV (spreadsheet-safe) or a Markdown table for your report.
Timezones: a timestamp carrying a zone (a trailing Z or an offset like +01:00) is placed at the exact instant it denotes — so 21:00:00+01:00 and 20:00:00Z are the same moment. A timestamp with no zone (classic syslog, bracketed, bare YYYY-MM-DD HH:MM:SS, Windows MM/DD/YYYY) is read in the assumed zone you pick below (default UTC) and flagged, because the log never recorded one. Everything is displayed in UTC. Unreadable timestamps are flagged, never guessed.
Drop a JSON timeline file here or click to browse
No events yet. Paste some logs, add an event, or click Load Sample to get started.