annatchijova·annatchijova/SKILLS/incident-timeline-reconstruction/SKILL.md

incident-timeline-reconstruction

Skill9 starsChanged 4 months agoLicence not identifiedView on GitHub

Build a defensible timeline of what happened from heterogeneous, imperfectly-clocked sources — separating recorded time from actual time, ordering from causation, and "no event" from "no coverage". Use whenever events from more than one source must be placed in sequence: incident response, outage postmortems, forensic investigations, breach reconstruction, distributed-system debugging across services, audit trails, or a "what happened when" question. Trigger on "build a timeline", "reconstruct what happened", "correlate these logs", "which came first", "the logs disagree", "clock skew", "root cause of the outage", "when did the attacker get in", or a paste of logs from two systems that need to be merged. Governs ordering, uncertainty, and gap discipline; the write-up itself goes to daubert-defensible-writing and the epistemic labels to claim-provenance-discipline.