Skip to content

About Case Timelines#

Gold Platinum

Case timelines provide a chronological view of all events that occurred during the lifecycle of a specific case.

This topic explains the components of case timelines in TheHive.

Other reports available

Components#

Case timelines consist of all types of events that have occurred in a case, including:

  • Alert occurrences
  • Case creation
  • Investigation start
  • Task completion
  • Flagged task logs
  • IoC sightings
  • MITRE ATT&CK patterns

Configure custom events to include additional entries in the timeline.

Rendering#

Display case timelines as either a graph or a list.

Actions#

Custom events can be created and deleted, but can't be edited after creation.

Next steps