Adding Timeline Events to the Canvas

  • Release version: Australia
  • Updated March 12, 2026
  • 1 minute to read

    • Add timeline events to the investigation canvas by adding the related entities to the canvas.

    Before you begin

    Role required: sn_sec_tisc.analyst

    Procedure

    1. Navigate to Workspaces > Threat Intelligence Security Center.
    2. Select the Threat Analyst Workbench icon.
    3. Go to Investigation Canvases > All Canvases.
    4. Select any canvas record.
    5. Go to Investigation Canvas section on the selected canvas record.
    6. Right click the desired node on the canvas, select Edit Timeline Event(s).
      The Edit Timeline Event(s) dialog box displays.

      Edit timeline eventAdd events to the timeline

    7. Select Add Event to add the custom timeline event.
    8. Select the Event and Timestamp of the event.
    9. Select Save to confirm your changes to add a timeline event to the selected investigation canvas.
      The event will be linked to the selected object and also include its timestamp. The visual presentation of the event including the icon and its color reflects the configuration defined during the setup.

      For information on how the timeline events are configured, see Configure Custom Event Types for Timeline.