All Collections
Post-incident analysis
Using Event Data
Creating an event filter and snake timeline
Creating an event filter and snake timeline
Lesleanne Blakeley avatar
Written by Lesleanne Blakeley
Updated over a week ago

Creating an event filter and snake timeline

By creating a single "Event" filter, you can tell the story of what happened during your incident: how it started, who helped, any remediation steps. Include all the tags you used in the first step of your investigation. A timeline can be created from the current event data by clicking the “Build a timeline” button. The number on the button tells you the number of events that will be in the timeline.

  • Create a filter: In the “Filtered By” box, select the names of the desired tags. In the “Select or Create a Filter” box type the name of your filter (“Event”) to create and save your filter.

  • Build the snake timeline: After you’ve selected what you’d like to filter by, click the “Build a Timeline” button to display the messages on a timeline. You can change the data in the timeline by searching or filtering.

    Here’s an example timeline:

Did this answer your question?