The First_Malicious_Action field specifies the time that the first malicious action related to this Incident occured.
The Initial_Compromise field specifies the time that the initial compromise occured for this Incident.
The First_Data_Exfiltration field specifies the first time at which non-public data was taken from the victim environment
The Incident_Discovery field specifies the first time at which the organization learned the incident had occurred.
The Incident_Opened field specifies the time at which the Incident was officially opened.
The Containment_Achieved field specifies the first time at which the incident is contained (e.g., the “bleeding is stopped”).
The Restoration_Achieved field specifies the first time at which the incident's assets are restored (e.g., fully functional)”.
The Incident_Reported field specifies the time at which the Incident was reported.
The Incident_Closed field specifies the time at which the Incident was officially closed.