Creating an event filter and snake timeline
By creating a single "Event" filter, you can tell the story of what happened during your incident: how it started, who helped, any remediation steps. Include all the tags you used in the first step of your investigation. A timeline can be created from the current event data by clicking the “Build a timeline” button. The number on the button tells you the number of events that will be in the timeline.
Create a filter: In the “Filtered By” box, select the names of the desired tags. In the “Select or Create a Filter” box type the name of your filter (“Event”) to create and save your filter.
Build the snake timeline: After you’ve selected what you’d like to filter by, click the “Build a Timeline” button to display the messages on a timeline. You can change the data in the timeline by searching or filtering.
Here’s an example timeline:
What's the difference between Narrative Builder and the snake timeline?
The snake timeline can be used to get a sense of events and where each event falls related to each other on a time scale perspective. The snake timeline view gives you the ability to look at all events together, rather than picking and choosing – like you can with narrative builder.
The snake timeline allows you to visualize key elements of the situation like "what time did each responder join" or "gaps in communication".
Have more questions about timeline building with Jeli? Give us a shout at support@jeli.io and we'd be happy to help!