Infection Timeline
Also known as: Infection date, Compromise timeline
An infection timeline is the chronological record of when a device was compromised and when its data was harvested, derived from infostealer log metadata. It helps responders scope exposure — what credentials were valid at the time and what to reset.
What is an infection timeline?
Stealer logs typically carry metadata indicating when the infection and data collection occurred. Reconstructing this timeline shows how long a device was compromised and which credentials and sessions were captured at that point.
Why the timeline matters
Knowing the infection date lets responders determine which credentials were active, whether subsequent password changes already mitigated the exposure, and how urgently to act — turning a raw log into an actionable response plan.
VantaPrism exposes infection-date metadata for each log, so analysts can scope exposure precisely and prioritise remediation based on what was valid at the time of compromise.
Check Your Exposure arrow_forwardFrequently Asked Questions
Why does the infection date matter?
Related Terms
A stealer log is the package of data exfiltrated from a single device by infostealer malware. It typically contains s…
Compromised credentials are usernames and passwords that have been exposed to unauthorized parties — frequently throu…
A session cookie is a token a website stores in the browser to keep a user logged in after authentication. Stolen ses…
Threat intelligence is evidence-based knowledge about threats — actors, tactics, and indicators — used to inform defe…