Attack timelines

Incidents laid out against the clock and the ATT&CK tactics, with the artifact each line rests on and whether it was observed or assessed.

A filled marker was observed: a record says it. A hollow one was assessed: inferred from the records either side. The strip across the top shows which tactics were touched, and an unlit tactic in the middle of a lit run is usually a step nobody has found yet.