Method
DFIR Timeline Consistency Checker
Checks whether incident timestamps, evidence sources and time-zone assumptions are internally consistent.
Field scoring contract
| Field | Type | Role | Direction | Scored |
|---|---|---|---|---|
| First seen timestamp | text | context | context | no |
| Alert timestamp | text | context | context | no |
| Containment timestamp | text | context | context | no |
| Time-zone handling | select | risk_driver | higher_is_worse | yes |
| Evidence sources | select | risk_driver | higher_is_worse | yes |
Limits
- Preliminary output
- Human review required
- Not certification
- Context text is not averaged into numeric scores.
- Outputs require source/evidence review before decisions.