Transforming scattered offense data into a clear, chronological attack story — empowering analysts to uncover hidden patterns, detect advanced threats, and respond with confidence.
Security analysts are under constant pressure to investigate thousands of alerts and offenses every day. The sheer volume of data, combined with the sophistication of modern threats, makes it difficult to spot what truly matters. QRadar 7.6.0 introduces the Attack Timeline, a breakthrough capability that redefines investigation workflows by surfacing the most critical milestones in an offense and stitching them together into a guided attack narrative.
What Is the Attack Timeline?
The Attack Timeline in the Offense Summary page converts complex offense data into clear visual milestones. These milestones represent significant historical events in an offense, allowing analysts to track the chronological progression of a cyber attack with precision.
Why It Matters
The Attack Timeline helps analysts:
- Focus on what matters most — zero in on the most important historical events out of thousands attached to an offense.
- Identify complex attack patterns — spot advanced persistent threats (APTs) that would otherwise be nearly impossible to detect with the human eye.
By surfacing critical events, QRadar enables faster, more confident decision‑making in the SOC.
Key Features
- Distributed Initial Access — milestones for new source IPs or usernames.
- Lateral Movement — milestones for new destination IPs or users attacked.
- New Tactics or Techniques — milestones for new rules contributing to the same offense.
Real-Life Use Case
Distributed Initial Access → Lateral Movement
At FinTrust Bank, attackers attempt a stealthy intrusion that unfolds in stages:
Step 1 – Distributed Initial Access
Multiple external IPs (203.0.113.45, 198.51.100.23) target low‑privilege accounts on teller workstations (FIN‑LAPTOP‑07, FIN‑LAPTOP‑12).
Attack Timeline Milestone: Flags each new source IP, username, and log source — exposing the distributed nature of the entry attempts.
Step 2 – Network Exploration & Credential Theft
Once inside, attackers query Active Directory, enumerate users, and steal cached credentials from jdoe_finance.
Attack Timeline Milestone: Captures every new rule triggered (for example, “Suspicious LDAP Enumeration”), showing the attacker’s shift in tactics.
Step 3 – Lateral Movement
Using stolen credentials, attackers pivot via RDP from compromised workstations into critical servers (HR‑SERVER‑02, DB‑SERVER‑01), targeting privileged accounts like hr_admin.
Attack Timeline Milestone: Highlights each new destination IP and user attacked, making lateral spread visible.
Step 4 – Targeting & Exfiltration
Sensitive payroll data is accessed and quietly exfiltrated to malicious-domain.net.
Attack Timeline Milestone: Surfaces outbound traffic to untrusted external servers, revealing the final stage of the attack.
Outcome: The Attack Timeline stitches these milestones into a guided attack story, helping analysts detect Advanced Persistent Threats (APTs) that blend into normal activity and are otherwise hard to spot.
What is an APT?
A stealthy and sophisticated cyberattack strategy used by highly skilled threat actors (often state-sponsored or well-funded groups) to infiltrate and remain within a target network for an extended period without detection.
Design Considerations
To make investigations even more effective, the Attack Timeline includes analyst‑friendly design features:
- Bookmark Milestones — Analysts can bookmark specific milestones to compare them side‑by‑side for deeper analysis.
- Filter Milestones — Filter by IPs, users, log sources, etc., to pivot investigations and focus only on relevant information.
- Copy to Clipboard — Share milestone details instantly with peers by copying all related event/flow data to the clipboard.
Looking Ahead
But this is just the beginning, as there is a lot more to come in the near future as part of the Attack Timeline enhancements. We plan to introduce MITRE TTP mapping to all Attack Timeline milestones so that analysts can detect attack patterns more efficiently. We also plan to show lateral movement across asset weights and flag the number of hits from each IP, user, and log source. In addition, the timeline will be enriched with relevant threat intelligence and UEBA information, making the Attack Timeline a true single pane of glass for offense investigations.
Call to Action
Upgrade your environment to QRadar 7.6.0 today to start using the Attack Timeline and transform the way your SOC investigates offenses.
We’d love to hear your feedback and suggestions on this feature — your input will help us shape the future of QRadar and make the Attack Timeline even more powerful.
Closing Thought
The Attack Timeline in QRadar 7.6.0 doesn’t just show data — it tells the story of the attack. By surfacing milestones at each critical step and offering analyst‑friendly tools, it empowers SOCs to cut through noise, spot hidden patterns, and protect organizations from sophisticated threats like APTs.
The Attack Timeline is redefining how analysts investigate threats — and this is only the beginning.