MULTI-FORMAT INGESTION
Five parsers · streaming
Linux, Windows, web, network and cloud evidence enter one schema.
DFIR • INCIDENT RECONSTRUCTION • DIGITAL FORENSICS
From log chaos to an attacker's story.
Chronos reconstructs complex multi-stage cyber breaches from thousands of fragmented events into one defensible forensic timeline.
SCROLL TO RECONSTRUCT
THE PROBLEM
The breach is rarely the problem.
The evidence is.
After a breach, responders face fragmented systems, inconsistent clocks, disconnected hosts, and transformation pipelines that can threaten evidentiary integrity.
CARD 01
Disparate Log Formats
01Linux auth.log
02Windows Security.evtx
03Web apache_access.log
04Network cisco_asa.log
05Cloud CloudTrail.json
CARD 02
Timestamp Chaos
0103:41:17 UTC
0203:42:04
0322:11:17 +05:30
04[timezone unknown]
05DRIFT DETECTED +47s
CARD 03
Correlation Paralysis
01Web exploit → ?
02Credential theft → ?
03SSH session → ?
04Cloud storage → ?
05RELATION UNKNOWN
CARD 04
Evidence Integrity
01RAW LOG
02↓ SHA-256
03SEALED EVIDENCE
04↓ NORMALIZATION
05FORENSIC REPORT
CHAOS → CHRONOS
What if the evidence could tell the story?
THE SOLUTION
Meet Chronos.
An automated forensic reconstruction engine that turns fragmented evidence into a defensible attacker narrative.
01
RAW EVIDENCE
02
SHA-256 INGESTION
03
UTC NORMALIZATION
04
ATT&CK TAGGING
05
CROSS-HOST CORRELATION
06
ANOMALY DETECTION
07
ATTACKER NARRATIVE
LIVE PROCESSING
EVENTS PROCESSED
184,392
SOURCES
5
TIMELINE
UTC
INTEGRITY
SHA-256 VERIFIED
01 / INGESTION
The first problem is ingestion.
Five systems. Five formats. One incident.
LINUXsshd: Accepted publickeyauth.log
WINDOWSEvent 4688 — Process CreationSecurity.evtx
WEBPOST /login HTTP/1.1 200apache_access.log
NETWORKTCP connection establishedcisco_asa.log
CLOUDeventName: PutObjectCloudTrail.json
CHRONOS
INGESTION ENGINE
INTEGRITY
SHA-256 VERIFIED
MANIFEST
ingest_manifest.json
RECORDS
184,392
SOURCES
5
02 / NORMALIZATION
Time should not be the reason evidence breaks.
HOST A
03:41:12
HOST B
03:42:00
HOST C
22:11:13 +05:30
HOST D
03:41:59
03:41:12 UTC
03:41:13 UTC
03:41:17 UTC
03:41:59 UTC
CLOCK DRIFT DETECTED: +47sOFFSET_INFERRED: TRUE
03 / BEHAVIOR
From events to adversary behavior.
TECHNIQUE
T1190
ASSOCIATED HOST
web-ext-01
NARRATIVE STAGE
INITIAL ACCESS
CORRELATED EVENTS
12 MATCHES
04 / CORRELATION
One event means little.
The relationship tells the story.
Internet
web-ext-01
win-eng-07
lin-db-03
s3-aerospace-vault
HOST
win-eng-07
ENTITY LINK
USER administrator
TECHNIQUE
T1003
06 / ANOMALIES
Find what doesn't belong.
Chronos highlights concentrated execution spikes and suspicious pauses between attacker stages.
LIVE STATISTICAL ANALYSIS
AUTHENTICATION SPIKE
Z-SCORE
3.82
DWELL-TIME GAP
4h 17m
05 / RECONSTRUCTION
The attack becomes a story.
Drag through the evidence, inspect a host, and follow the attacker across the environment.
CHRONOS● LIVE INVESTIGATION
SEARCH EVENTS, HOSTS, ENTITIES
03:41:17 UTCEVT-001
POST /login
web-ext-01 · T1190
03:44:21 UTCEVT-017
Process Creation
win-eng-07 · T1003
03:48:03 UTCEVT-029
Token elevation
win-eng-07 · T1548
04:02:13 UTCEVT-042
SSH Login
lin-db-03 · T1021.004
04:14:32 UTCEVT-068
Archive created
lin-db-03 · T1560
04:21:47 UTCEVT-091
PutObject
s3-aerospace-vault · T1041
ATTACKER NARRATIVE THREAD · ANT-001
EVENT
POST /login
HOST
web-ext-01
SOURCE
apache_access.log
ATT&CK
T1190
LATERAL MOVEMENT GRAPH
Internet
web-ext-01
win-eng-07
lin-db-03
s3-aerospace-vault
HOST
win-eng-07
ENTITY LINK
USER administrator
TECHNIQUE
T1003
ANOMALY INSPECTOR
LIVE STATISTICAL ANALYSIS
AUTHENTICATION SPIKE
Z-SCORE
3.82
DWELL-TIME GAP
4h 17m
One incident.
One timeline.
One defensible story.
ARCHITECTURE
Built as a forensic pipeline.
LAYER 1 · RAW FORENSIC SOURCES
Linux
Windows
Apache / Nginx
Cisco
AWS CloudTrail
LAYER 2 · NORMALIZATION & TAGGING
Parser Pipeline
UTC Normalization
Clock-Skew Detection
ChronosEvent Schema
LAYER 3 · CORRELATION & REPORTING
Cross-Host Correlation
MITRE ATT&CK Tagger
Anomaly Detection
SQLite Event Indexer
LAYER 4 · INVESTIGATION
Timeline
Narrative
Host Graph
ATT&CK Matrix
Reports
CHAIN OF CUSTODY
Evidence remains defensible from ingestion to report.
01
SOURCE FILE
02
SHA-256
03
INGEST MANIFEST
04
NORMALIZED EVENT
05
CORRELATED EVIDENCE
06
FORENSIC REPORT
ALGORITHM
SHA-256
DIGEST
8f7a...3d92
VERIFICATION
✓ VERIFIED
TECHNICAL CAPABILITIES
Built for the realities of incident response.
UTC NORMALIZATION
ISO 8601 · UTC
Every event is aligned while original timestamps remain preserved.
CLOCK-SKEW DETECTION
offset · confidence
Drift and inferred timezones stay explicit and reviewable.
ATT&CK TAGGING
technique · tactic
Observed events become recognizable adversary behavior.
CROSS-HOST CORRELATION
IP · user · process
Shared entities connect activity across hosts and systems.
ANOMALY DETECTION
z-score · dwell
Execution spikes and suspicious pauses surface automatically.
NARRATIVE THREADS
ordered · explainable
Correlated evidence becomes a defensible attacker journey.
FORENSIC EXPORT
JSON · CSV · summary
Investigations leave the system in portable review formats.
Reconstruct the incident.
Turn fragmented forensic evidence into a chronological, explainable attacker narrative.
BUILT FOR FORENSICS & INCIDENT RESPONSE