incident-timeline-normalizer

When to invoke

• You have incident notes/events from multiple systems and need a consistent timeline.
• You want basic metrics like time-to-detect and time-to-mitigate.

Inputs needed

• --events_json: Path to input events JSON.
• --out_json: Path to write normalized timeline JSON.

Events JSON format (reference implementation)

• incident_id (string)
• events[]:
  • timestamp (string; ISO-8601, RFC-2822, or epoch seconds)
  • type (string; e.g., detected, acknowledged, mitigated, resolved, note)
  • message (string)