An analyst prepares an after action report following an incident in which multiple systems were compromised over several days. The analyst provides raw event logs from each compromised system in the report and determines that a patient-zero system cannot be found. Which of the following should the analyst do to determine the patient-zero system?

To identify the "patient zero" (the initial point of compromise), an analyst must establish an accurate, synchronized timeline of events across all affected systems. Raw event logs from multiple systems often have disparate timestamps, clock drift, or different time zones. By normalizing these logs and constructing a unified timeline, the analyst can trace the sequence of malicious activities backward to the earliest occurrence, thereby identifying the first compromised system and the initial attack vector.

B. Enabling monitoring is a containment and preparation step; it does not help analyze historical raw logs to find the initial compromise.
C. Isolating systems is a containment action to stop ongoing attacks, which does not assist in historical log analysis for patient zero.
D. Improving shift handoff communication is an administrative process improvement, not a technical forensic analysis technique.
E. Reverse composition analysis focuses on malware structure and dependencies, not on tracing network-wide lateral movement to find patient zero.

1. NIST Special Publication 800-61 Revision 2, "Computer Security Incident Handling Guide," Section 3.2.4 (Analyzing Incident-Related Data - Profiling and Timing).

2. MITRE ATT&CK Framework, "Incident Response Methodologies: Timeline Analysis."