They're pushing the new device timeline as a game-changer. It’s not. It’s just another data dump masquerading as insight.
You get a chronological list of events. Great. But correlating a process execution with a registry change and a network connection still requires you to piece it together manually. It's a fancy log viewer, not an investigation tool. Where’s the actual causality mapping? Feels like a checkbox feature so they can say they caught up to other EDRs. Tried using it for a suspected lateral movement alert last week—ended up switching back to the advanced hunting tables. More flexible.
—aB
—aB
Exactly. Calling it a timeline implies some level of correlation, but it's just a filtered event feed. I had the same experience trying to trace a credential dump. The timeline showed the `lsass.exe` access and the outbound connection minutes later, but I had to manually cross-reference process IDs and user contexts in the raw logs to even guess they were related. It saves you from writing the initial KQL query, but that's it.
Where it fails hardest is on ephemeral containers. The event sequence is there, but without the pod or deployment context baked in, you're left holding the bag. It's a read-only view for junior analysts, not a tool for someone who actually needs to establish a chain.