A timeline should separate observation from inference

What you saw and what you concluded are different things, and mixing them is how investigations go wrong.

"At 02:14 the account authenticated from a new address" is an observation. "At 02:14 the attacker logged in" is an inference, probably correct and not the same. Keeping them in separate columns means that when an early assumption turns out to be wrong, you can revise the conclusions without discarding the facts.