About the Timeline

The timeline provides a view of milestones and tasks within an investigation. Most timeline events are auto generated, such as when ThreatQ first encountered an object and how the threat intelligence data was discovered, for example, via feed. When you create a task, it is also added to the timeline. Finally, you can create a timeline event associated with or independent of an object.

Timeline Rows

The Timeline displays entries in one of three row categories:

• Tasks - displays the task and extends to the due date on the timeline (if supplied).  
• Investigation - displays timeline entries, both automatically generated and manually added.  
• Selected - plots on the Timeline when the selected system object was first seen/reported by a threat intelligence source.

Viewing a Timeline Entry Summary

After an item is added to the timeline, you can view a summary of that item in the investigation workbench. Some of these panels allow you to perform actions, such as launching an object's details page and deleting a task.

1. From the investigation workbench, select an item on the timeline.

2. Double-click the item to open the summary panel.

Deleting an TimeLine Entry Summary

You can delete Timeline Entries that you by clicking on the entry within the timeline and clicking on the delete icon.  

You can delete entries for the Tasks and Investigation timeline rows but not from the Selected row.