AI incident timeline reconstruction
Order recorded events while preserving time zones, duplicates and missing timestamps. A timeline organises evidence; it does not establish causation.
Synthetic evaluation input
id,timestamp,event E-1,2026-08-20T08:00:00+01:00,record A E-2,2026-08-20T07:30:00Z,record B E-1,2026-08-20T08:00:00+01:00,duplicate record A E-3,,record C without timestamp
Original Inzonex training example, version 1.0. No customer document or real equipment data. No model has been scored on this page.
Expected fields
| Field | Reference answer |
|---|---|
| ordered_known_ids | ["E-1", "E-2"] |
| E-1_utc | "2026-08-20T07:00:00Z" |
| unknown_time_ids | ["E-3"] |
| duplicate_id | "E-1" |
| cause_established | false |
Check a structured response
The comparison runs in your browser against this answer key. It checks exact fields and values, not the accuracy of an explanation or a model's general ability.
Recommended workflow
Normalise explicit timestamps using deterministic date handling, keep unknown times separate and retain the original log IDs beside the ordered result.
The order displayed in an exported log may not be chronological. Different systems can use different offsets, and a repeated row may be an export duplicate rather than a second event. These issues should be resolved before asking for a narrative.
The synthetic packet includes two explicit time zones, a duplicate event and an event with no timestamp. The correct timeline converts the known times to UTC, removes the repeated record from the unique order and leaves the untimed event outside that order.
Do not let a chronological list become a causal conclusion. Clock synchronisation, logging delays and incomplete records can limit what an incident review can establish. A useful AI summary distinguishes recorded facts from hypotheses and identifies the evidence gaps.
Failure checks
- Convert E-1 to UTC before ordering.
- Do not place E-3 at an invented time.
- Do not infer a cause from this event list.
What this exercise does not prove
A synthetic timestamp exercise, not an incident investigation, root-cause finding or assessment of system clock accuracy.
For an actual evaluation, keep a separate held-out set, record tool/model version and settings, and log raw outputs, corrections, elapsed time and actual charges. Do not compare tools tested on different inputs as though they ran the same benchmark.
What is checked in AI incident timeline reconstruction?
Order recorded events while preserving time zones, duplicates and missing timestamps. A timeline organises evidence; it does not establish causation.
What does AI incident timeline reconstruction not prove?
A synthetic timestamp exercise, not an incident investigation, root-cause finding or assessment of system clock accuracy.
Related tasks
Match this workflow to your data requirements
Methodology and reuse
These packets and answer keys are original Inzonex educational material, licensed CC BY 4.0. Attribute Inzonex and link to this task page when reusing the packet. The licence does not cover third-party material linked from this site.
NIST AI 600-1: background on generative AI evaluation and risk. This exercise is not NIST-certified.