About Timelines

A Timeline activity is an action or event that is recorded within an Incident. These activities are stored in the Timeline Database and must be associated with a specific Incident for proper tracking and organization. Timeline activities should generally only be created from within an Incident to ensure they are tied to the incident they belong to.

All Timeline activities are stored in the and are tagged according to the Incident they belong to. If an Incident is deleted, it’s Timeline activities will remain and become “unassociated.” See: Unassociated Items

Timeline Database Fields

Timeline activities contain the following items

• Name
  • The observed activity
• Starred
  • A way to identify an entry of particular interest for quick filtering
• Timestamp (UTC)
  • The UTC timestamp that the activity occurred.
• Parent Incident
  • The Incident this activity belongs to
• Affected Assets
  • Assets this activity occurred on or against
• Involved Accounts
  • Accounts involved in this activity
• Observed IOCs
  • IOCs observed within the context of this timeline activity