Case Timeline

Case Timeline tracks how the team handled the case: opened, request received, analysis started, analysis ended. It is not the place for attacker findings or IoCs. Those belong on Findings.

Create an event

1. Open Case Timeline.
2. Click Create.
3. Enter the event, notes, and dates.

Each event can have a start date and an end date. If you omit the end date, the event is a single-point milestone.

Edit or delete

Right-click an event on the chart and choose edit or delete.

Use the date-range control to focus the chart.