Lesson 5 — Understanding the Device Timeline

Learning objectives

After completing this lesson, you should be able to use the Device Timeline to reconstruct endpoint activity.

• Explain what the Device Timeline contains.
• Read events in chronological order.
• Search and filter timeline activity.
• Follow parent and child process relationships.
• Correlate process, file, network, registry and logon evidence.

The problem this solves

An alert may show only one suspicious event.

The Device Timeline provides the surrounding activity needed to understand how the event started, what it triggered and what happened next.

Chronological evidence

Timeline events are organised by time so analysts can see the order in which activity occurred.

Small differences in timestamps can reveal which process, user action or connection caused the next event.

Start with the alert

When an alert exists, use its timestamp and affected device as the initial pivot.

Open the Device Timeline around that time and expand the window until the full sequence becomes visible.

Move backwards

Moving backwards helps identify the origin of suspicious activity.

Look for the parent process, user action, downloaded file, scheduled task or earlier logon that led to the detected event.

Move forwards

Moving forwards helps determine impact.

Look for child processes, persistence, file creation, network communication, credential access or lateral movement after the original event.

Process events

Process creation events show which executables ran and how they were launched.

Command lines, account context, hashes and parent-child relationships are often central to endpoint investigations.

Parent and child processes

Every suspicious process should be examined in context.

A legitimate binary can become suspicious when launched by an unusual parent or when it creates an unexpected child process.

Command-line evidence

Command lines can reveal switches, URLs, encoded content, file paths and attacker intent.

Do not rely only on the process name. The command line often explains what the process was instructed to do.

File activity

File events can show when files were created, modified, renamed, deleted or downloaded.

Correlate the file path, hash, originating process and timestamp with the rest of the timeline.

Network activity

Network events show remote IP addresses, domains, ports and the processes responsible for the connection.

A network connection becomes more meaningful when tied to the process and command line that created it.

Registry activity

Registry events can reveal persistence, configuration changes and security control modification.

Pay particular attention to autorun locations, service settings and changes made by unusual processes.

Logon activity

Logon events help identify which users, accounts or sessions were active on the endpoint.

This context can connect device activity with a compromised identity or lateral movement attempt.

Scheduled tasks and services

Attackers may create scheduled tasks or services for persistence and execution.

Review the creating process, account, command and timing to decide whether the activity is expected.

Security alerts in the timeline

Alerts can appear alongside surrounding device activity.

This helps analysts understand which events Defender considered important and what occurred around the detection.

Timeline search

Use timeline search to locate known filenames, process names, users, domains, IP addresses or commands.

Search is especially useful when the device contains a large amount of activity.

Useful process searches

Common investigation searches include powershell.exe, cmd.exe, rundll32.exe, mshta.exe and certutil.exe.

These binaries are legitimate, so always interpret them through their command line, parent process and surrounding activity.

Filtering by event type

Filter the timeline to focus on processes, files, network connections, registry changes, logons or alerts.

Filtering reduces noise, but remove filters when you need to understand cross-event relationships.

Filtering by time

Use a narrow time range for precise analysis and a wider range when searching for initial access or persistence.

Attackers may establish access hours or days before the alert is generated.

Expanding an event

Expand important timeline events to review all available properties.

Details may include hashes, paths, command lines, users, remote addresses, initiating processes and detection context.

Initiating process

The initiating process explains what caused an event.

For a network connection or file creation, this field may be more important than the event itself.

Follow the same hash

A file hash can connect multiple file and process events.

Use it to determine whether the same binary appeared elsewhere on the device or across the organisation.

Follow the same user

User context can connect endpoint events to identity activity.

Check whether the same account signed in elsewhere, triggered other alerts or accessed additional devices.

Pivot to Advanced Hunting

Use Advanced Hunting when you need broader retention, custom filtering, multiple tables or cross-device comparison.

The timeline is excellent for visual reconstruction, while KQL is better for repeatable and organisation-wide analysis.

Pivot to the incident

The parent Defender XDR incident may contain email, identity or cloud evidence not visible in the Device Timeline.

Use both views to understand the complete compromise.

Timeline evidence and response

Timeline findings help determine whether isolation, scanning, evidence collection or Live Response is required.

Containment decisions should be based on the full sequence and business impact.

Do not confuse absence with safety

A missing event does not always mean the activity did not occur.

Check device health, sensor status, event availability and whether another telemetry source is required.

Common mistake

A common mistake is investigating only one suspicious event.

The event may be the middle of the attack rather than the beginning.

Another common mistake

Do not assume a familiar executable is safe.

Legitimate tools can be abused, and their parent process, command line and network behaviour may reveal malicious intent.

Best practices

• Start at the alert timestamp.
• Move backwards to find the cause.
• Move forwards to determine impact.
• Follow parent and child processes.
• Correlate files, network, registry and users.
• Pivot to the incident and Advanced Hunting.

Agent Foskett takeaway

The Device Timeline is where isolated endpoint events become a complete sequence.

By following time, process relationships and related evidence, analysts can reconstruct attacker behaviour and make better response decisions.