Incident Timeline

The incident timeline shows the occurrence of the following events in time for a specified incident:

• IQ events — The incident events, such as incident started, runbook launched, and incident end.

• Lifecycle events — The lifecycle events, such as indicators added, note added, and indicators updated.

• Indicators — The primary indicator and any correlated indicators associated with this incident.

The image below shows the incident timeline view.

Each item on the timeline has an associated label. Most, but not all, labels contain a link which opens a dialog with additional information when clicked. Here is a description of the links that are provided:

• View Indicator — Displays the chart with the data for the earliest indicator.

• View List — Displays the table of correlated indicators.

• View Automation — Displays the Debug Runbook Flow view for the previously run incident or lifecycle runbook.

The timeline shows the events in the order they occurred. But the event spacing is not based on the true time elapsed between successive events, they are equally spaced based on the width of the screen. To zoom in on a portion of the timeline, click the mouse where you want to start the zoom and drag to where you want to end the zoom and release the mouse. To reset the zoom back to its original state, click Reset Zoom. Clicking on individual legend items allows you to filter the timeline, for example to only show event types selected in the legend.