docs: add log timeline evidence gates

[catcherintheroad-hub]

Summary

Adds timeline-integrity and evidence-handling gates to log-analysis so incident conclusions are calibrated by timestamp normalization, log pipeline health, and preserved raw evidence.

Changes

• Added LOG-TIME-01 through LOG-TIME-06 for timezone, clock skew, ingestion timestamp confusion, log gaps, parser loss, and duplicate event handling.
• Added LOG-EVID-01 through LOG-EVID-05 for raw source references, query text, hashes/immutability, redaction, and raw-event spot checks.
• Added required timeline metadata and confidence calibration tables.
• Extended the output template with time normalization, evidence handling, and timeline integrity sections.
• Added pitfalls for exact timelines from ambiguous timestamps and transformed SIEM fields without raw evidence.
• Added NIST SP 800-86 as a forensic evidence-handling reference.
• Added edge-case fixtures for mixed local/UTC logs, incident-window pipeline gaps, and normalized fields without raw exports.

Validation

• git diff --check
• Added-line non-ASCII scan
• Added-line prompt-injection marker scan
• NIST SP 800-86 reference URL returned HTTP 200

Related issue

Created from review issue: #1338

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fd16398e29

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require all missing-evidence gates in the fixture

This fixture has no raw export path, no hash, and only normalized SIEM fields, so it simultaneously satisfies LOG-EVID-01, LOG-EVID-03, and LOG-EVID-05 as defined in the new skill checks. Using or lets a report pass while ignoring two of the missing-evidence conditions, which weakens the edge-case coverage for the evidence gates this test is meant to validate.

Useful? React with 👍 / 👎.