Network events take place in real-time. This means they have important stages of development that go beyond the moment data is lost and most security technology alerts are launched. As a result, crucial events occur within the kill chain before security teams are even aware of the attack. The further along the chain an attacker goes, from reconnaissance through weaponization to action on objectives, the more leverage they gain. A retrospective viewpoint enables teams to study the genesis of complex threats as they form, and rather than patch the symptoms of a breach, teams can trace it back to its source. By analyzing the past, security professionals can direct intelligent action forward. When immersed in a network, time is relative.