Creating an event filter and snake timeline
By creating a single "Event" filter, you can tell the story of what happened during your incident: how it started, who helped, any remediation steps. Include all the tags you used in the first step of your investigation. A timeline can be created from the current event data by clicking the “Build a timeline” button. The number on the button tells you the number of events that will be in the timeline.
Create a filter: In the “Filtered By” box, select the names of the desired tags. In the “Select or Create a Filter” box type the name of your filter (“Event”) to create and save your filter.
Build the snake timeline: After you’ve selected what you’d like to filter by, click the “Build a Timeline” button to display the messages on a timeline. You can change the data in the timeline by searching or filtering.
Here’s an example timeline:
