Lining events up with sort

One story from two files

An incident usually shows up in more than one log. The attacker logs in (login log), then visits a web page (web log). Read separately, the pieces are confusing. Put them together and sort them by time, and the story reads in order:

cat /tmp/events.txt | sort

In the terminal

student@vulntech:~$ cat /tmp/events.txt | sort
09:13:55 ssh login failed from 203.0.113.45
09:14:07 ssh login succeeded from 203.0.113.45
09:14:40 web request /admin from 203.0.113.45

sort put the failed login first, then the success, then the web visit — exactly the order they really happened. A clear timeline like this is often the single most useful thing in an incident report.

Tip: Building the timeline is also where you catch gaps: “they logged in at 09:14, so what happened in the next five minutes?”