Breach Timeline Builder
Dated breach notes become a sorted timeline with pivots, gaps and exports.
Timeline
How the breach timeline works
Each line is one event. One date is read from the line (ISO formats are tried before written and slash dates), the rest becomes the event text, and lines with no date are listed under the timeline so nothing is dropped.
- Types come from keywords: leak (leak, dump, paste, forum, for sale), credentials (password, hash, SSO, MFA, session cookie), secrets (API key, token, commit, private key), exposure (exposed, bucket, misconfigured) and infrastructure (certificate, subdomain, VPN, CVE). A line with none of them is a note.
- Severity adds points per type and for words such as ransomware, admin, password reuse, customer or finance. 6 or more is high, 3 to 5 is medium.
- Observables: domains, emails, IPs, CVEs, hashes, AWS keys, GitHub and Slack tokens are pulled from each line.
- Gaps: missing evidence types, rows without an observable, ambiguous dates and any gap longer than 45 days between events.
How to read the result
The axis spaces extracted dates by time. Grey means unassessed; red, amber and green encode analyst-assigned high, medium and low severity; tap a dot to open that event. Each event shows its age, its types and its observables, and opens to next steps for its types. Pivots are the threads to pull first: the same host, email or key turning up on two dates. Severity is an evidence priority cue and does not prove a breach.
Breach timeline FAQ
Which date formats does it read?
2026-08-13, 2026/08/13, 2026-08-13T10:22Z, 20260813, 13 Aug 2026, 13 August 2026, Aug 13, 2026, 13.08.2026, 13/08/2026 (or 08/13/2026 with the month/day setting), and month-only dates such as Aug 2026. One date is read from each line: ISO dates are tried first, then compact, written, dotted and slash dates, then month-only dates, and the first format that matches is used.
What happens to slash dates like 03/09/2026?
When both parts are 12 or less, the Slash dates setting decides between day/month and month/day, and the event is flagged as an ambiguous date. When one part is above 12, the order is worked out from it.
How is severity scored?
Keywords provide a priority hint only. Every row starts with unassessed severity and unreviewed source status. Save a rationale to assess severity or status; corroborated status also requires a source reference. The tool does not verify source truth.
What is a pivot?
An observable that appears in two or more events: a domain, email, IP address, CVE, hash, AWS key, GitHub token or Slack token. Pivots link events that may belong to the same incident. Tap one to filter the timeline to those events.
Are my notes uploaded or saved?
No. Parsing runs in this page, nothing is sent to a server, and the notes are not saved in the browser. Export CSV or JSON if you want to keep the timeline.
Use public signals: leak claims, credential sightings, repo secrets, exposed hosts, certificate changes and disclosures.