Reconstruct an IR timeline from heterogeneous log inputs.
Script Body
I will paste log excerpts from multiple sources (SIEM, EDR, firewall, cloud audit). Build a unified timeline in chronological order with columns: timestamp_utc, source, event_summary, asset, user, indicator. Then add a Phases section mapping events to the Lockheed Martin Cyber Kill Chain (Recon, Weaponization, Delivery, Exploitation, Installation, C2, Actions on……