Time boundaries
On this page
The time window an investigation runs over is a decision, not a default. Different threat types deserve different windows, and choosing deliberately keeps the work bounded and the evidence defensible.
Two kinds of time
Lookback window (historical)
Looking backward from the alert. How far back the investigation pulls evidence. Short windows (hours to a day) work for fast-moving attacks like ransomware staging. Longer windows (weeks to months) are needed for slow-burn insider cases or campaigns that establish persistence over time.
Forward window (live)
From the alert until containment or close: what you watch as it happens, so that new activity, scheduled execution, or attacker reaction is caught while the case is open. It shapes how quickly the handoff to incident response needs to be ready.
Choosing the historical window
Fast-moving. The attack typically progresses within hours, and the relevant evidence is recent. Pair it with an extended look (1 to 4 weeks) at the enabling intrusion: the access being ransomed rarely began today.
Initial access happened recently; the question is what the adversary did with it after. Pair it with a 14-30 day lookback for identity persistence artifacts (consent grants, mailbox rules, MFA method changes) on the affected identities: those can predate the alert. The identity-persistence sweep lists where each one is logged.
Lateral movement can begin within minutes of initial access (CrowdStrike’s 2026 Global Threat Report puts average eCrime breakout time at 29 minutes) or after long quiet periods in espionage intrusions. The 1-4 week window exists to find the first foothold and the full trail of expansion, not because movement is slow.
The compromise may predate the alert by weeks or months. Both the alert and earlier silent activity matter.
The trajectory is what reveals the case. A short window will not capture the gradual deviation.
Median dwell for this class is about four months (M-Trends 2026), and some campaigns exceed a year. Expect the window to exceed retention: name the dark stretch, and pull appliance, VPN and hypervisor logs early because they often rotate fastest.
These ranges are starting points, not measurements. Published incident data shows why they spread so widely: M-Trends 2026 reports a 14-day global median dwell time Dwell Time The interval between initial compromise and detection, measured per incident and tracked as a program metric. The reason retention windows matter ("did this start before the alert?") is that dwell time is routinely longer than anyone's comfort. Mandiant's M-Trends 2026 puts the global median at 14 days (up from 11), but espionage and North Korean IT-worker intrusions had a median of 122 days. The median hides a long tail, and that tail is what retention windows must cover. and 122 days for cyber-espionage intrusions, while CrowdStrike’s 2026 Global Threat Report puts average eCrime breakout at 29 minutes. Recalibrate against your own case history each year.
Retention is a real constraint
The window the analyst chooses is bounded by what the SOC actually retains. If retention is 30 days and the case calls for a 6-month look, the investigation has to acknowledge that gap rather than pretend it does not exist. Document the retention limit as part of the Scope output.
Four elements of a defensible historical review
Historical context is foundational to triage. Analysts cannot determine whether activity is malicious without understanding what normal looks like. Effective historical review anchors on four investigation elements.
Establishing review timeframes
Match the window to the threat type using the table above, and write down why. For long windows, analyze the most recent 60-90 days in full detail and summarize the older range as the baseline it is compared against.
System log considerations
Account for log retention periods, business cycles (financial closes, audits, holiday slowdowns), and the lookback needed for typical attacker dwell time. The right window may exceed what the SIEM retains, in which case backups, archives, or complementary systems with longer retention come into play.
Technical & organizational baselines
Understand normal network traffic, typical user behavior, and business rhythms like seasonal spikes and recurring maintenance windows. Misinterpreting expected patterns as malicious produces false alarms and needless escalations, and erodes trust in the triage process.
Multi-source timeline
Correlate authentication logs, network flows, endpoint telemetry, and application logs across consistent timeframes. The relationships between seemingly disparate events are often where the real picture emerges. A timeline anchored in only one source misses the inter-tool story.
Write every window in UTC. Note any source that logs local time or is known to drift. Ingest lags event time, so an empty result for the past few minutes may mean the data has not arrived yet: query on event time, and re-run before concluding absence (see clock skew in Uncover).
A historical-review pitfall to avoid
Low-fidelity sources, such as aggregated NetFlow NetFlow Cisco's flow-export format: per-connection metadata (5-tuple, bytes, packets, timestamps) without payloads. Standardized as IPFIX (RFC 7011); cloud equivalents are AWS VPC Flow Logs, Azure VNet flow logs and GCP VPC Flow Logs. or summarized access logs, reveal general trends but lack the specificity needed to track session-based behavior or detect subtle anomalies. High-fidelity logs (full packet captures, process command lines, registry modifications) enable deep forensics Forensics The application of scientific methods to collect, preserve, and analyze digital evidence so that findings hold up to scrutiny: disk and memory images, log exports, mobile extractions, each with a documented chain of custody. In triage the forensic move is preservation: capture volatile evidence, and hash what you export, before containment changes the system. but impose storage and indexing burdens.
The mistake is choosing fidelity by default rather than by need. Triage often starts with low-fidelity sources to confirm a pattern exists, then expands to high-fidelity sources for the specific time windows that pattern surfaces. Pulling full packet captures on day one for a four-week investigation is almost always wasted effort. Pulling them targeted at the 2-hour window where the suspicious traffic Network Traffic The data moving between hosts on a network, observed as connections, flows, and packets. In triage, traffic metadata (who talked to whom, when, how much, and over which port and protocol) is often the fastest way to confirm or rule out command and control, exfiltration, or lateral movement. occurred is the methodology working.
Real-time investigation considerations
The historical lookback comes from the table above. The forward window starts at the alert and stays open until containment or closure. Extend the lookback only when the evidence points to long-term persistence Persistence The ATT&CK tactic for keeping access across reboots, updates and password changes. Mature actors plant several anchors: Run keys, scheduled tasks, services, WMI event subscriptions, and in the cloud, OAuth apps and added MFA methods. , recurring patterns, or deferred execution Execution The ATT&CK tactic (TA0002) for running attacker-controlled code on a local or remote system: through command interpreters, user-run files and lures, scheduled tasks, WMI, or exploits. It rarely stands alone: attackers execute code to discover, steal, move or persist. , and record that evidence with the extension.
The forward window’s job is different from the lookback. The lookback builds the picture of what happened. The forward window tracks what is happening now and prepares the response.
Lateral movement attempts
Immediately after detection, watch for privilege escalation, credential reuse, or attempts to move into adjacent systems. Real-time monitoring of authentication systems is essential when credential theft is suspected.
Scheduled or periodic execution
Tasks that did not fire during the initial detection window but are configured to run later. Scheduled tasks, cron jobs, service abuse, and beacon callback intervals all deserve attention in real-time.
Defense impairment and reaction
Log tampering, process termination, disabling security tooling. These may be planned pre-impact steps (ATT&CK Defense Impairment, TA0112) or a reaction to being noticed; either way, impact may be close. Also watch for attacker-driven lockouts and admin password resets (T1531, Account Access Removal), which look different from brute-force side effects or defender containment. Capturing them in real time both preserves evidence and informs the response posture.
C2 / beacon follow-up
For malware events with implants or beacons, outbound traffic and DNS patterns should be tracked across the environment in real time. Additional infected systems or fallback infrastructure often surface this way.
Real-time prioritization
It is rarely feasible to maintain continuous visibility across the entire environment in real time. Scope decides where to focus that finite attention.
Directly affected critical assets
Hosts and accounts explicitly named in the investigation’s primary entity list. Continuous attention until containment is in place.
Systems with elevated access
Domain controllers, identity providers, cloud control planes, key vaults. If they were touched during the alert window, they get real-time eyes. This applies whether the system is primary or secondary: a touched control-plane system gets real-time monitoring even when its investigation depth is baseline-only.
Anomalous-after-the-alert hosts
Any system that started showing unusual behavior after the initial alert was raised. Often the first sign of attacker pivot or alternate persistence channel.
Operational considerations
- Coverage model. In an 8/5 SOC, Scope must decide before end of shift who watches the forward window overnight (on-call, MDR, or automated containment rules) and write that into the handoff (see what transfers at a shift handover). In a 24/7 SOC, name the shift that inherits the watch.
- Containment Containment The incident-response phase between detection and eradication: isolate the affected hosts, revoke the compromised credentials, block the C2 destinations, freeze the situation so it stops getting worse while the investigation continues. In triage, preservation comes first: capture the volatile evidence and the artifacts a containment action would destroy, then take only the reversible actions the protocol pre-authorizes. Non-reversible actions, such as a credential reset or an OAuth grant revocation, need IR or owner approval unless the protocol lists them as pre-authorized for that scenario. timing. A few actions (isolating a host, disabling an account, terminating a session) may be on your SOC’s written list of pre-authorized immediate actions; everything else waits for incident response Incident Response The organized approach to handling a security incident once it is declared. The classic lifecycle (NIST SP 800-61r2, withdrawn in 2025, and SANS PICERL) runs preparation; detection and analysis (identification); containment, eradication and recovery; post-incident activity (lessons learned). NIST SP 800-61r3 (April 2025) now maps incident response onto the CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover). Triage is the front edge of that lifecycle; ASSURED ends where IR takes ownership. . Scope does not grant that authority. It records which pre-authorized actions apply to the in-scope entities, and what has to be preserved before any of them runs (volatile evidence, and the artifacts the action would destroy), so they are ready if the playbook’s trigger is met. Preserve before you contain: the order of operations is on Preserve before you contain, and the authority question on containment authority.
- Time-boxing. Open-ended investigations consume resources without producing results. Scope sets a soft deadline at which the case is reassessed (converge, re-scope, or report “still investigating” to whoever owns the clock) even if not every thread has been chased: for example, a first convergence check 45 minutes into Uncover (10:35 UTC in Case A). Typical full-arc phase times (diagnostic ranges, not quotas) are in the time-per-phase table; alerts that do not earn a full Scope take the fast path.
Key takeaway
The right window depends on the threat: hours to a day for fast-moving attacks, 3-12 months for insider and slow-burn cases (with the most recent 60-90 days examined in full detail against the older baseline). Choose it deliberately, document why, and move it only on documented extension triggers, not curiosity.
Next up
Entity boundaries
Primary and secondary entities, relationship mapping, access modeling, dependency tracing.
Read entity boundariesTechnical details verified . Product names, defaults and retention change; check your own tenant.