Incident Timeline

The incident timeline shows the occurrence of the following events in time for a specified incident:

• IQ events — the incident events, such as incident started, runbook launched and incident end.

• Lifecycle events — the lifecycle events, such as indicators added, note added, indicators updated.

• Indicators — the primary indicator and any correlated indicators that were associated with this incident.

The incident timeline view is shown below.

Each of the items on the time line has a label associated with it. Most, but not all, labels contain a link that opens a dialog with additional information when you click on it. Here is a description of the links that are provided:

• View Indicator — this displays the chart with the data for the earliest indicator.

• View List — this displays the table of correlated indicators.

• View Automation — this displays the Debug Runbook Flow view for the incident or lifecycle runbook that was run.

The timeline shows the events in the order they occurred but their spacing is not based on the true time elapsed between successive events, they are equally spaced based on the width of the screen. To zoom in on a portion of the timeline, click the mouse where you want to start the zoom, drag to where you want to end the zoom and release the mouse. To reset the zoom back to its original state, click Reset Zoom. Clicking on individual legend items allows you to filter the timeline and just show event types selected in the legend.