Timeline

Use Timeline as your workspace for investigations and threat hunting. You can add alerts from multiple indices to a Timeline to facilitate advanced investigations.

You can drag or send fields of interest to a Timeline to create the desired query. For example, you can add fields from tables and histograms on the Overview, Alerts, Hosts, and Network pages, as well as from other Timelines. Alternatively, you can add a query directly in Timeline by expanding the query builder and clicking + Add field.

In addition to Timelines, you can create and attach Timeline templates to detection rules. Timeline templates allow you to define the source event fields used when you investigate alerts in Timeline. You can select whether the fields use predefined values or values retrieved from the alert. For more information, refer to Create Timeline templates.

To make a new Timeline, choose one of the following:

To open an existing Timeline, choose one of the following:

To avoid losing your changes, you must save the Timeline before moving to a different Elastic Security app page. If you change an existing Timeline, you can use the Save as new timeline toggle to make a new copy of the Timeline, without overwriting the original one.

You can select whether Timeline displays detection alerts and other raw events, or just alerts. By default, Timeline displays both raw events and alerts. To hide raw events and display alerts only, click Data view to the left of the KQL query bar, then select Show only detection alerts.

To further inspect an event or detection alert, click the View details button. A flyout with event or alert details appears.

Many types of events automatically appear in preconfigured views that provide relevant contextual information, called Event Renderers. All event renderers are turned off by default. To turn them on, use the Event renderers toggle at the top of the results pane. To only turn on specific event renderers, click the gear () icon next to the toggle, and select the ones you want enabled. Close the Customize event renderers pane when you’re done. Your changes are automatically applied to Timeline.

The example above displays the Flow event renderer, which highlights the movement of data between its source and destination. If you see a particular part of the rendered event that interests you, you can drag it up to the drop zone below the query bar for further investigation.

You can also modify a Timeline’s display in other ways:

The Timeline table shows fields that are available for alerts and events in the selected data view. You can modify the table to display fields that interest you. Use the sidebar to search for specific fields or scroll through it to find fields of interest. Fields that you select display as columns in the table.

To add a field from the sidebar, hover over it, and click the Add field as a column button (), or drag and drop the field into the table. To remove a field, hover over it, and click the Remove field as a column button ().

Expand the query builder by clicking the query builder button () to the right of the KQL query bar. Drop in fields to build a query that filters Timeline results. The fields' relative placement specifies their logical relationships: horizontally adjacent filters use AND, while vertically adjacent filters use OR.

Click a filter to access additional operations such as Add filter, Clear all, Load saved query, and more:

Here are examples of various types of filters:

To attach a Timeline to a new or existing case, open it, click Attach to case in the upper right corner, then select either Attach to new case or Attach to existing case.

To learn more about cases, refer to Cases.

You can view, duplicate, export, delete, and create templates from existing Timelines:

You can export and import Timelines, which enables you to share Timelines from one space or Elastic Security instance to another. Exported Timelines are saved as .ndjson files.

To export Timelines:

To import Timelines:

Use the Correlation tab to investigate Timeline results with EQL queries.

When forming EQL queries, you can write a basic query to return a list of events and alerts. Or, you can create sequences of EQL queries to view matched, ordered events across multiple event categories. Sequence queries are useful for identifying and predicting related events. They can also provide a more complete picture of potential adversary behavior in your environment, which you can use to create or update rules and detection alerts.

The following image shows what matched ordered events look like in the Timeline table. Events that belong to the same sequence are matched together in groups and shaded red or blue. Matched events are also ordered from oldest to newest in each sequence.

From the Correlation tab, you can also do the following:

The Elasticsearch Query Language (ES|QL) provides a powerful way to filter, transform, and analyze event data stored in Elasticsearch. ES|QL queries use "pipes" to manipulate and transform data in a step-by-step fashion. This approach allows you to compose a series of operations, where the output of one operation becomes the input for the next, enabling complex data transformations and analysis.

You can use ES|QL in Timeline by opening the ES|QL tab. From there, you can:

To get started using ES|QL, read the tutorial for using ES|QL in Kibana. Much of the functionality available in Kibana is also available in Timeline.

To find examples of using ES|QL for threat hunting, check out our blog.