Dynatrace introduces a feature in its Security Investigator tool that utilizes reference time to enhance the analysis of security incidents by using relative timestamps. This feature allows engineers to perform root cause analyses more efficiently by setting a reference time for events related to an incident, which creates a virtual column called "timestamp_diff" to display the time difference between events and the incident. This capability enables users to maintain the context of an incident across various data points, making it easier to track and understand the sequence of events. The use of reference time facilitates complex security investigations, allowing engineers to build DQL queries based on their findings, save evidence, and navigate through investigation histories with ease. This feature integrates diverse information, ensuring a consistent incident context, which significantly speeds up threat hunting and incident response times.