Use Case: Incident Response
Forensic timeline construction
The attacker was in the environment for 18 days before detection. ManySignal assembled the complete forensic timeline — from initial phishing email to data exfiltration — across 9 log sources in 2 hours.
18 days of attacker activity across 9 log sources
Forensic timeline construction requires precise correlation of events across disparate systems with different timestamp formats, different schemas, and different retention windows. An analyst building a timeline manually must export logs from each source, normalize the timestamp formats, import them into a spreadsheet or analysis tool, and then cross-reference by entity (user, host, IP) — a process that takes 2-3 days for a complex intrusion and is error-prone enough to miss important relationships.
ManySignal's entity graph pre-links all events at ingestion time. Forensic timeline construction becomes a query, not a project: select the entity, select the time range, and ManySignal returns every related event in chronological order across every source simultaneously.
query: forensic_timeline
entity: user="j.smith@corp.com" OR host="CORP-WS-0441"
time_range: 2024-10-01T00:00Z to 2024-10-19T23:59Z
sources: all # EDR, CloudTrail, Okta, M365, proxy, firewall
event_types:
- authentication: login, logout, mfa, password_change
- process: exec, inject, spawn, terminate
- network: connection, dns, proxy, firewall
- file: create, modify, delete, exfil_indicator
- identity: role_change, policy_change, token_issue
- cloud: api_call, resource_create, permission_change
output:
- timeline: chronological, all sources, deduped
- pivot_points: entity_hops (user -> host -> role -> service)
- phase_labels: initial_access, persistence, lateral, exfil
- ioc_highlights: known_bad_matches from threat_intel
- evidence_export: sha256_signed, chain_of_custodyTimeline phases detected
Evidence chain composition
MITRE ATT&CK mapping
Forensic timeline FAQ
What data sources does ManySignal correlate for forensic timeline construction?
ManySignal correlates: EDR process execution trees (CrowdStrike, SentinelOne, Microsoft Defender), Windows Event Logs (Security, System, PowerShell), Linux auditd and syslog, cloud provider audit logs (AWS CloudTrail, GCP Audit Logs, Azure Activity Log), identity provider logs (Okta, Entra ID), network proxy and firewall logs, and SaaS audit trails (Microsoft 365, Google Workspace, Salesforce). All events are normalized to a common timestamp and entity model.
How does ManySignal handle timestamp discrepancies across log sources?
ManySignal normalizes all timestamps to UTC and applies clock drift correction based on NTP deviation analysis. When log sources have known drift, ManySignal applies the correction factor. Events that arrive out of order (due to ingestion delay) are re-sequenced by event timestamp rather than ingestion timestamp. The forensic timeline shows both event time and ingestion time for each entry.
Can forensic timeline exports be used as legal evidence?
ManySignal generates evidence packages with SHA-256 hashes of all source log evidence, a chain of custody record showing who accessed the investigation and when, and a signed export file. The export format is accepted by major eDiscovery platforms and can be certified for court proceedings. ManySignal recommends involving legal counsel and a qualified forensic examiner for litigation-level evidence handling.
Does ManySignal preserve evidence from ephemeral sources like containers?
Yes. ManySignal's eBPF sensor (powered by Falco or Tetragon integration) captures process execution, network connections, and file system events from containers before they terminate. Container lifecycle events are preserved in the entity graph along with the container image, namespace, and pod context, enabling post-mortem forensic analysis of short-lived workloads.
Build the complete 18-day attack timeline in 2 hours
Entity graph across 9 log sources — every event, every pivot, signed and chain-of-custody ready for legal review.