## Incident Timelines

The most critical part of an Incident Report.

### Precision is Key
*   **Bad**: "The hacker got in around noon."
*   **Good**: "12:01:45 PM UTC - Attacker IP 1.2.3.4 successfully authenticated."

### UTC vs Local Time
**ALWAYS USE UTC**.
*   Attacker is in Russia (+3).
*   Server is in AWS (+0).
*   Analyst is in New York (-5).
*   Management is in California (-8).
Using local time creates a disaster. Standardize on UTC.