--- title: "Timeline Events | ThreatConnect" slug: "timeline-events" description: "This article describes how to view and filter a Case's Timeline Events and add a Timeline Event to a Case manually." tags: ["Case Management"] updated: 2024-03-20T23:09:05Z published: 2024-03-20T23:09:05Z canonical: "knowledge.threatconnect.com/timeline-events" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Timeline Events ## Overview The timeline in a [Workflow Case](/v1/docs/workflow-cases) is a recording of actions performed in the Case in chronological order. Timelines enable security teams to quickly observe key events over a span of dates in a Case. They also allow users to drill down into important timeframes in the lifespan of a Case. When an action is performed in a Case, a Timeline Event is added automatically to the Case’s **Timeline**card, which shows a timeline of all the changes made to the Case. This article describes how to view and filter Timeline Events, as well as how to manually add a Timeline Event to a Case. ## Before You Start | Minimum Role(s) | - Organization role of Read Only User (for viewing Timeline Events) - Organization role of Standard User (for creating Timeline Events and editing those created by the user) - Organization role of Organization Administrator (for editing user-created Timeline Events, regardless of which user created them, and deleting user-created Timeline Events) | | --- | --- | | Prerequisites | Workflow enabled by a System Administrator; a Workflow Case created in your Organization (see[Creating Cases](https://knowledge.threatconnect.com/v1/docs/creating-cases)) | ## Timeline Card Figure 1 shows an example of the **Timeline**card for a Case, which is located below the [**Notes**card](/v1/docs/case-notes) on the right side of the screen displaying the Case. NoteTo collapse or expand the **Timeline** card, hover the cursor anywhere in the card and click the arrow displayed at the upper-right corner of the card. ![Graphical user interface, text, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-a5l1obdw.png) Each Timeline Event includes an icon indicating the type of Case element to which it corresponds: - ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-xk1ec0ax.png): [Case](/v1/docs/workflow-cases), [Attribute](/v1/docs/case-attributes), or [Association](/v1/docs/case-associations) - ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-9biw2q95.png): [Task](/v1/docs/phases-and-tasks) - ![A picture containing text, furniture, file Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-z0f24rqk.png): [Artifact](/v1/docs/artifacts) - ![A picture containing gear Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-lsfvk5z1.png): [Note](/v1/docs/case-notes) - ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-g5v7hj7b.png): [Playbook execution](/v1/docs/workflow-playbooks) Click on a Timeline Event to view the name of the user who performed the action corresponding to it (Figure 2). ![Graphical user interface, text, application, email Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-nbff3req.png) To hide the details, click on the Timeline Event again. ## Adjusting Timeline Display Settings ### Changing the Timeline Order Timeline Events are ordered from newest to oldest by default. To view the oldest Timeline Events at the top of the **Timeline**card, click the **Change Order** ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-3hftf2d6.png) icon at the top right of the card. The order of Timeline Events will be reversed (Figure 3). Click the **Change Order**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-469czacw.png)****icon again to revert to the original (newest to oldest) order. ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-tudaorwu.png) ### Changing the Timeline Increment You can group Timeline Events more closely or space them further out by changing the time increment. The default time increment is **Hour**. If desired, select another increment from the time increment dropdown menu at the top right of the **Timeline**card, to the right of the search bar. For example, selecting **Day** will condense all Timeline Events that took place on a particular day into a single block (Figure 4). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-sp0lz6fi.png) ## Adding Timeline Events To add a Timeline Event to the Case, click the **New… ![A picture containing clock Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-ldgepxj1.png)**button at the upper-right corner of the Case and select **Timeline Event**, or hover the cursor over the **Timeline**card and click on the **plus ![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-yv4ob3m0.png)**icon displayed at the upper-right corner of the card. The **Create Event**drawer will be displayed (Figure 5). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-96nmjovl.png) - **Event Date**: Select the date and time when the Timeline Event occurred. - **Summary**: Enter the details for the Timeline Event. - Click the **SAVE**button. The Timeline Event will be added to the Case and displayed in the **Timeline**card. ## Editing Timeline Events Only Timeline Events that were added manually to a Case may be edited. To do so, click on the Timeline Event to expand it (Figure 6). ![A screenshot of a cell phone Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-v2em820t.png) Click **EDIT**at the lower-right corner of the expanded Timeline Event. The **Create Event**drawer will be displayed (Figure 7). ![A screenshot of a cell phone Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-zpiougl4.png) - Make the desired changes to the Timeline Event. - Click the **SAVE**button. ## Filtering Timeline Events ### FILTERS Selector The **FILTERS**selector provides options for filtering displayed Timeline Events by user, type of linked Case element that generated the Timeline Event, whether the Timeline Event was generated manually by a user or automatically by the system, the date on which the Timeline Event was added, and combinations of these selections (Figure 8). ![Graphical user interface, application Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-8u7xxwjk.png) - **User**: Select one or more users. Only Timeline Events created by the selected user(s) will be displayed. - **Linked Type**: Select one or more types of linked Case elements. Only Timeline Events generated by the selected element(s) will be displayed. - **Generated**: Selecting **System**will display only Timeline Events generated automatically by the system, whereas selecting **Manual** will display only Timeline Events manually added by a user (see the “Adding Timeline Events” section). Selecting **All**will display all Timeline Events regardless of how they were generated. - **Date Added**: Clicking on the **from**and **to** fields displays calendars from which the beginning and end of a date range can be selected. Only Timeline Events that were generated on dates within that range will be displayed. - Click the **APPLY**button to apply the selected filters. To reset the filters, click the **CLEAR**button. When filters have been applied, an orange circle ![Logo, icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-a3kdm3wg.png) will be displayed at the upper-left corner of the **FILTERS**selector. This element alerts you to the fact that you might be viewing an “incomplete” set of data. ### Filtering Timeline Events by Name To filter Timeline Events by name (i.e., contents of the Timeline Event), enter the desired term in the search bar to the right of the **FILTERS**selector. The displayed Timeline Events will be filtered as text is entered into the search bar. Click the **Clear** ![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/timeline-events-image-i7uaje70.png) icon on the right side of the box to clear the entered text. --- *ThreatConnect® is a registered trademark of ThreatConnect, Inc.* 20129-01 v.01.C ## Related - [Artifacts](/artifacts.md) - [Case Notes](/case-notes.md) - [Parts of a Case](/parts-of-a-case.md) - [Phases and Tasks](/phases-and-tasks.md) - [The Cases Screen](/the-cases-screen.md) - [Workflow Overview](/workflow-overview.md) - [Workflow Playbooks](/workflow-playbooks.md)