Incident Timeline Builder

A local workspace for reconstructing what happened and when — useful well beyond security incidents: an application outage, a service failure, a deployment gone wrong, a network incident, a customer-impacting event, or an authentication issue all benefit from a clean timeline. Add entries by hand, paste timestamped lines, import CSV/JSON, or pull in results sent from the Authentication Log Analyzer or Firewall Log Parser. Runs entirely in your browser — nothing is uploaded, and by default nothing is saved once you leave the page (see "Clear workspace" below).

Timezones and conflicts

Each entry's timestamp is interpreted using its own Timezone field when the timestamp string itself doesn't carry one (an explicit Z or +HH:MM in the timestamp always wins). "Normalize all to UTC" rewrites every entry's displayed timestamp to UTC without losing the original — both are always shown side by side. Entries whose resolved times land within one second of each other are outlined as a conflict — not necessarily wrong, but worth checking (clock drift between sources is common). Exact duplicate entries (same timestamp, title, and description) are marked duplicate rather than silently merged.