These four sources disagree on time — put the attacker actions in their true order.
You are scoping an incident on host WS-419 and have one line from each of four defender log sources.
Constraints:
- Sources record in different zones; the file server is known to run 47 minutes fast.
- Normalise everything to UTC, then state the true sequence.
vpn.log 2026-03-04 05:58:11Z auth success user j.orlov from 198.51.100.9
edr_alerts.json 2026-03-04 06:15:02Z WS-419 (10.2.4.19) new service installed
fileserver.audit 2026-03-04 09:52:00 +03:00 mass read of \\FS1\hr by j.orlov
firewall.log 2026-03-04 09:22:44 +03:00 outbound 10.2.4.19 -> 203.0.113.7:443 1.4 GBReconstruct the timeline and say which entry you must correct before trusting it.
Normalise to UTC and fix the skew first — the file server runs 47 minutes fast, so its 09:52 +03:00 entry is really 06:05Z. True order is VPN logon 05:58Z, mass file read 06:05Z, service installed 06:15Z, then the 1.4 GB egress at 06:22Z.
- ✗Ordering by the printed digits without converting zone offsets to UTC
- ✗Adding the drift of a fast clock instead of subtracting it
- ✗Discarding a skewed source instead of correcting it by a measured offset
- →How would you measure and record a host clock offset so the correction is defensible?
- →Which additional source would confirm the VPN logon was the initial access?
Work in order: normalise, then correct, and only then draw conclusions.
vpn.log 05:58:11Z already UTC
edr_alerts.json 06:15:02Z already UTC
fileserver.audit 09:52:00 +03:00 = 06:52:00Z, minus 47 min fast = 06:05:00Z
firewall.log 09:22:44 +03:00 = 06:22:44ZTrue sequence: VPN logon (05:58Z) -> mass read of the HR share (06:05Z) -> a new service installed on WS-419 as persistence (06:15Z) -> 1.4 GB pushed outbound (06:22Z). The entry to correct is the file-server audit: without subtracting the 47 minutes it lands after the egress and paints a false picture in which data left before it was read. Measure and record the clock offset in the case file, or the correction itself cannot be defended.
