Reconstructing Incidents From Events You Already Keep

Many organisations already store the events needed for a credible timeline—they simply never assemble them. Reconstruction starts with a shortlist of incidents, not a fishing expedition across every log store.

Align timestamps, actors, and application surfaces. Note where clock skew or missing fields force inference. Inference is allowed; unmarked inference is not.

Look for recurring shapes: the same privilege path, the same silent skip after a deploy, the same partner webhook that never acknowledges. Patterns deserve measurement changes, not only process notes.

End with a detection gap list. If the next similar incident would still be invisible for forty minutes, the reconstruction has not finished its job.