Build a Timeline

Part of the Investigating a Breach section of Coddy's Cybersecurity journey. Lesson 11 of 20.

A timeline helps you explain how an incident unfolded. Read events in time order and separate what happened before cleanup from what happened afterward.

The practice computer’s logs show a program starting before a transfer:

seclab logs

Look for these lines:

2026-11-01 08:56:00 practice-laptop PROCESS_STARTED demo-helper parent=demo-browser
2026-11-01 08:58:00 practice-laptop DATA_TRANSFERRED demo-upload: training-records.csv

The process record links demo-helper to its parent, demo-browser. Together, the records support a short explanation: the browser launched the helper, then the helper’s connection transferred a file.

Do not turn a guess into a finding. If the records only show a connection, you cannot claim that data left. Record the starting process for this example:

seclab answer first demo-browser

You should see:

Recorded your answer to first.

Earlier evidence is carried into later tickets as a saved file named evidence followed by the computer name. This keeps the original record available after cleanup.

Challenge

Easy

Ticket from Sam, IT lead

Prepare the beginning of the roastery incident timeline. Use the saved evidence and logs to identify the parent that launched the unwanted helper. Record that parent as first. Keep the cleaned helper stopped and the approved backup working while you investigate.

Try it yourself

Terminal

All lessons in Investigating a Breach

1Follow the Evidence

Running Programs Parent Processes File Fingerprints Save the Evidence Another Report

4Prove the Recovery

Check Normal Work Watch for a Return Write the Findings Return to Service The Stock Room

2Make the Cleanup Last

Stop the Program Quarantine the File Startup Entries Test the Restart The Returning Program

3Work Out What Happened

Build a TimelineDid Data Leave?Find Another Copy Restore a Safe Program The Contractor’s Report