Following the recovery from a ransomware incident, the incident response lead is preparing for the post-incident review. Before the lessons-learned meeting, the lead wants to produce a single artifact that chronologically documents every detected event, analyst action, and containment decision with precise timestamps sourced from correlated logs. Which artifact should the lead create to best support the review?