A case study author knows the date an organization publicly confirmed an attack but cannot verify when the attacker first gained access. Explain how the timeline should represent this uncertainty.

### The concept An incident timeline is an evidence-based account, not a story that fills gaps with guesses. The time an attack began can differ substantially from the time an organization detected or disclosed it. A case study should label these dates separately, include time zone where available, cite the source for each event, and mark unavailable facts as not publicly reported. This lets readers distinguish verified facts from interpretation and prevents a discovery date from being mistaken for the attack's onset. ### What a good answer covers - Separate occurrence or suspected onset from discovery and public confirmation. - Cite the source for the confirmed date. - Mark the onset as unknown or not publicly reported if unsupported. - State how that uncertainty limits conclusions about dwell time or response speed. ### Terms - **Dwell time**: The period an attacker remains in an environment before detection. ### Remember Report what the evidence supports, and label what it does not establish.