By connecting the first known data point to successive, related data points, the analyst can discover the full breadth of an attack.