An incident timeline should help another analyst understand what is known. Use a consistent timezone, link to evidence, and keep interpretation distinct from the observed event.
Record uncertainty
If a timestamp is approximate or a source is incomplete, say so. Precision in presentation should not imply precision in the evidence.
Link the source
Give each important entry a reference to the record that supports it. Preserve relevant originals according to your investigation process.
Revise openly
When new evidence changes an interpretation, update the timeline and retain the reason for the change.
Original sample editorial content for the preview edition.