How should a SOC analyst document an investigation timeline effectively? What details should be captured, and how does a well-constructed timeline help the broader incident response effort?

Sample answer preview

An investigation timeline is a chronological record of events related to a security incident, combined with the analyst's investigative actions and findings. It serves as the backbone of any incident report and is essential for understanding how an attack unfolded and how the…