Build an ordered, evidence-linked incident timeline with first/last seen, dwell time and pivot points; use when a case spans multiple alerts, hosts or stages and needs a clear narrative.
