An attack timeline is the sequence and duration of stages in an intrusion, from initial access through reconnaissance, privilege escalation, lateral movement, data collection, and exfiltration or sabotage. It matters because security teams do not only need to know what happened, but how fast it happened and which steps overlapped.
In real attacks, a short timeline can indicate automation, good operator discipline, or the use of agentic tools that chain actions together quickly. Defenders use timelines to spot gaps in detection, measure dwell time, and identify where an intrusion could have been interrupted. Abnormal speed, repeated tool use, and tightly ordered account activity can all suggest that an attack is being orchestrated rather than performed manually. A clear timeline helps teams prioritize containment and improve alerts around the most time-sensitive stages.