Timestamp Audit Checklist

The Timestamp Audit Checklist is a practical log analysis tool for security practitioners who need to verify their environment's time infrastructure is accurate, consistent, and defensible. Missing UTC offsets, outdated DST rulesets, undocumented SIEM normalization, and unmonitored NTP drift are among the most common silent failures in incident response and digital forensics investigations. This checklist walks practitioners through a four-part audit covering per-log-source inventory, ingestion pipeline health, NTP configuration, and time zone change readiness, so teams can identify and fix timestamp gaps before they corrupt a timeline or hide attacker activity.

This content supports SEC401: Security Essentials.