Skip to content
ENExplore Calculators

Timeline Analysis Calculator

Estimate super-timeline effort from source count, event volume, deduplication, noise filtering and analyst review rate.

About Timeline Analysis Calculator

A super-timeline merges filesystem, registry, event-log, browser and application artefacts, so the raw event count is the product of sources and per-source volume. Deduplication removes the same action recorded in several places, and known-good filtering removes routine operating-system noise; what survives is the set a human must actually look at. The elapsed figure combines machine ingest time with human review capacity, because only one of those scales by adding analysts. Timelines fail on the human side, not the tooling: 1.5 million events is a fortnight of review, which is why filtering hard and scoping to a suspected window is the only way most investigations finish.

Formula

Timeline Analysis

reviewableEvents = sources × eventsPerSource × (1 − dedupRate) × (1 − filterRate); elapsed = (ingestTime + reviewableEvents ÷ (reviewRate × analysts)) ÷ productiveHoursPerDay.

dedupRate
Share of events that are duplicates across sources
filterRate
Share removed by known-good and hash allow-lists
reviewRate
Events one analyst can meaningfully review per hour

Worked example

With the default values below, Timeline Analysis Calculator returns Elapsed Analysis Time of 27.1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Evidence sources in the timelineaccepts 1–500 sources
6 sources
Events extracted per sourceaccepts 100–500,000,000 events
250,000 events
Duplicate events removedaccepts 0–95 %
35 %
Known-good noise filtered outaccepts 0–99 %
60 %
Tool ingest rateaccepts 100–5,000,000 events/s
15,000 events/s
Events an analyst reviews per houraccepts 10–100,000 events/hour
1,200 events/hour
Analysts on the timelineaccepts 1–100 analysts
2 analysts
Productive analysis hours per dayaccepts 1–24 hours/day
6 hours/day

Results

Elapsed Analysis Time
27.1 days
Events Extracted
1,500,000 events
Events Left to Review
390,000 events
Data Reduction Achieved
74.0%
Tool Ingest Time
0.03 hours
Analyst Review Time
162.5 hours
Feasibility Verdict
Not reviewable event by event — pivot to targeted analysis around known indicators

Step by step

  1. 1Values used
  2. 2Timeline Analysis
  3. 3Elapsed Analysis Time= 27.1 days
  4. 4Events Extracted= 1,500,000 events
  5. 5Events Left to Review= 390,000 events
  6. 6Data Reduction Achieved= 74.0
  7. 7Tool Ingest Time= 0.03 hours
  8. 8Analyst Review Time= 162.5 hours

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Timeline Analysis calculated?

reviewableEvents = sources × eventsPerSource × (1 − dedupRate) × (1 − filterRate); elapsed = (ingestTime + reviewableEvents ÷ (reviewRate × analysts)) ÷ productiveHoursPerDay. A super-timeline merges filesystem, registry, event-log, browser and application artefacts, so the raw event count is the product of sources and per-source volume. Deduplication removes the same action recorded in several places, and known-good filtering removes routine operating-system noise; what survives is the set a human must actually look at. The elapsed figure combines machine ingest time with human review capacity, because only one of those scales by adding analysts.

Why does Timeline Analysis matter?

Timelines fail on the human side, not the tooling: 1.5 million events is a fortnight of review, which is why filtering hard and scoping to a suspected window is the only way most investigations finish.

What values do I need to enter?

This calculator takes 8 inputs: Evidence sources in the timeline, Events extracted per source, Duplicate events removed, Known-good noise filtered out, Tool ingest rate, Events an analyst reviews per hour, Analysts on the timeline, Productive analysis hours per day. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is filtering 60% of events safe?

It is standard practice with a maintained known-good hash set and event allow-list, but it is a risk you accept explicitly. Attackers abuse signed system binaries precisely because they land inside the allow-list, so keep the filtered set retrievable rather than deleted.

Why does the review rate vary so much?

It depends on what you are doing. Scanning for a known indicator runs at tens of thousands of events per hour; reconstructing an unknown intrusion narrative, where each entry needs context and correlation, runs closer to a few hundred.

Related Calculators

Timeline Analysis Calculator | Calcrivo