A reconstruction is for one incident, not a quarter. The aim is a shared clock: when the first detector fired, when someone picked up the ticket, when a change was rolled back, and where the notes simply stop. We draw that sequence as a timeline with source marks, then a short narrative that stays inside what the records support.
This work often sits beside an after-action review you already run. We do not replace that review. We give the chair a picture that stops the meeting arguing about the order of events, so the remaining time can go on decisions you still owe.
Who it is for
Incident commanders and post-incident chairs who need a single timeline everyone in the room can follow.
What you receive
A reconstruction pack: annotated timeline, detection list, and a one-page narrative of what was known at each hour.
Scope
One named incident, from first detection to declared close, using the records you already hold.
Included
- Source review of tickets, chat exports, and detector notes you provide
- Master timeline with detection and decision marks
- One revision after the chair’s comments
- Forty-five minute remote readout
Not included
- Live containment advice during an open incident
- Attribution of threat actors
- Rewriting your formal after-action report unless separately commissioned
Who prepares it
Contenttrailcore, Ford, Shropshire.
Sequence
- Incident name and close time confirmed
- Records received under your classification rules
- Draft timeline issued
- Readout and final files
Time
Five to ten working days after records arrive, depending on how scattered the notes are.
Where the work happens
Remote. Printed boards for a workshop room can be arranged.
What to prepare
Gather the ticket thread, detector hits, and any change tickets that sat in the same hours. Redact names if your policy requires it.
Limits we will not blur
We will not place events on the timeline without a source line. Conflicting clocks are shown as conflicting clocks.
Fees
From £2,400 excluding VAT. Incidents that span more than five calendar days are quoted after we see the record volume.
Next step
Send the incident name and the date it was closed. We will confirm whether the records are sufficient.