View and filter the incident timeline

  • Release version: Zurich
  • Updated May 25, 2026
  • 1 minute to read

    • View the chronological timeline of events for a security incident and filter by event type to focus on relevant activities.

    Before you begin

    Role required: sn_si.analyst

    Procedure

    1. Navigate to Workspaces > Security Incident Response Workspace.
    2. Open a security incident.
    3. Select the Timeline tab on the incident overview.

      The timeline displays all configured events in chronological order. Point events appear as individual markers, and range events appear as colored bars.

    4. Select any event to view its details in a popover.
    5. To filter events, use the event type filter to select or deselect specific event types.

      The timeline updates to show only the selected types. Filtering applies only to your current view.

    Result

    Note:
    If you do not see expected events, contact your administrator to verify the event configuration is active.