Timeline
What happened, in the order it happened, whether DFIRe saw it or you found it.
What the timeline holds
The timeline records what happened to a case. DFIRe writes most of it for you, and you add what it could not see: the events your analysis uncovered.
Entries group by date and carry UTC timestamps. A Case Opened separator divides what happened before the case existed from what happened during it, which is what makes a backdated entry read correctly.
What DFIRe records for you
DFIRe automatically logs these events to the timeline:
| Event Type | Description |
|---|---|
| Case lifecycle | |
| Case Created | Someone opened the case. |
| Case Closed | Someone closed it. |
| Case Reopened | Someone reopened it. |
| Case Acknowledged | Someone took the case on. It is now in progress. |
| Case Set Back to New | Someone reset the acknowledgement. The case is new again. |
| Resolution SLA Paused | Someone paused the resolution SLA timer. |
| Resolution SLA Resumed | The resolution SLA timer runs again, by hand or at the resolution or closure. The entry says how long the pause lasted. |
| Case Archived | Someone archived it, which locks it against every edit. |
| Escalated to Incident | An investigation became an incident. |
| Priority / Severity Changed | The priority or severity moved, recording the old and the new value. The event reads "Investigation priority changed" or "Incident severity changed". When an escalation or a phase change also changes the severity, this event follows that event. |
| Lead Investigator Changed | The lead investigator changed, arrived or left. |
| Incident Phase Changed | The incident moved to another phase. The event records whether the severity was reviewed during the change, and the severity before and after. |
| Playbook Changed | The case moved to a different playbook. |
| Evidence | |
| Evidence Added | New evidence item added to the case |
| Evidence Step Updated | Evidence item's processing step changed (e.g. Acquisition → Analysis) |
| Custody Transfer | Chain-of-custody transfer recorded on an evidence item |
| Case File Added | Attachment uploaded to the case |
| Evidence File Added | Attachment uploaded to an evidence item |
| Notes & actions | |
| Case Note | Note added to the case |
| Evidence Note | Note pinned to an evidence item |
| Action Started | An action was taken (assigned and moved to Started) |
| Action Completed | Someone completed an action. |
| Action Blocked | Someone blocked an action. The entry shows what the action waits on, with a red X icon. |
| Action Details Updated | Someone edited an action's description or details, or unblocked it. |
| Action Note Updated | Someone added a note to an action, added an update to the note, or edited the note. The first note and each update show their text. An edit shows only that the note changed. |
| CAN Report Updated | A new version of the CAN report exists. |
| Compliance timers | |
| Compliance Timer Started | Someone started a compliance timer. The entry shows the framework, the duration and the deadline. |
| Compliance Timer Warning | A timer passed a warning threshold, at 50%, 25% and 10% remaining. The entry shows the framework, the time left and the deadline. |
| Compliance Timer Breached | A timer passed its deadline before someone completed it. The entry shows the framework and the deadline. |
| Compliance Timer Completed | Someone completed a timer. The entry shows the framework and whether someone completed the timer before or after the deadline. |
| Indicators | |
| Indicator Added | An indicator joined the case. |
| Indicator Classification Changed | An indicator's classification changed. Every open case that holds the indicator records it. A bulk change records one entry per case that lists its indicators. |
| Manual entries | |
| Manual Entry | Someone added an entry by hand, optionally backdated. |
DFIRe records these wherever the change came from: the case screen, Slack, an automation rule or the API. Each event names the person who made the change. Changes made by an automation rule are attributed to Automation, and events with no originating user show as System.
Adding an entry yourself
Add Entry on the Timeline tab records something DFIRe could not observe. Give it a subject, optional detail, and the time it actually happened, in UTC. Choose Event happened now for something current, or set a past date to place it correctly in the sequence.
Choose a Style for the entry. The preview under the field shows the entry as it will appear. When the entry records something the attacker did, choose Adversarial event. The timeline shows it in red, and the Adversary Activity filter finds it. A Major event or an Action event can also have a Color. Edit the entry later to change its style or color.
Tip: Use manual entries to document events that happened before the case was opened, such as initial malware detection, first sighting dates, or compilation timestamps.
Bulk import: Timeline events can also be imported in bulk from a CSV file via the Import button on the Timeline tab. A preview step shows which rows will be created or updated before anything is written.
Hiding an event
Noise can be hidden rather than deleted. Edit an event and turn on Hidden from timeline. The event stays in the record and comes back whenever you want it.
Seeing what is hidden
The hidden button in the toolbar shows how many events are hidden and brings them back into view. A hidden event is dimmed and marked Hidden event.
Note: Case Created and Phase Changed events cannot be edited, as they record what the case itself did. Phase changes can still be hidden from the report; the Case Created event cannot.
Cards and table
The Timeline tab shows the entries as cards along a line, or as a table. Switch between them with Cards and Table above the list. Your browser remembers the choice.
Each kind of entry has a style: Major event, Adversarial event, Alert, Action event, Update or Minor event. A superuser sets the style of each kind (see Timeline settings). In the table, the left edge of a row has the color of its card. The text of an entry shows as formatted Markdown or as plain text, as the settings say. A note card shows the images pasted into the note, and the table shows the name of each image instead.
The table shows Time, Phase, Event, Details and By. Add Type or remove columns with Columns. Click a column heading to sort by that column. Phase sorts in the order of the incident phases, not by name. The last column has the controls of each entry: view a note, edit the entry, and hide it from the report or show it again.
Selecting entries
In the table, Select... adds a checkbox to each row and a box that selects all of them. With entries selected:
- Hide from report and Show in report change all the selected entries at once.
- Export selected downloads only the selected entries as a CSV file.
Without a selection, Export downloads the whole timeline.
Filtering and sorting
The timeline toolbar provides several options to focus on specific events:
Event Type Filter
Use the "All Events" dropdown to filter by specific event types:
- Manual Entries
- Adversary Activity
- Phase Changes
- Priority / Severity Changes
- Lead Changes
- Actions Started / Actions Completed / Actions Blocked
- Evidence Added / Step Changes
- Case Files / Evidence Files
- Case Notes / Evidence Notes
Sort Order
Click the sort button to toggle between:
- Newest First: Most recent events at the top (default)
- Oldest First: Earliest events at the top
Incident phases
For incident cases, the timeline integrates with incident phases:
- Phase indicator: Each event shows the incident phase when it occurred
- Phase changes: Phase transitions are highlighted as prominent events
- Change phase: Click the current phase in the toolbar to change to a different phase
Phase changes create timeline events automatically, documenting when the incident moved between phases and who made the change.
Timeline settings
Superusers set how each kind of entry appears under Settings → Case Properties → Timeline. The page shows an example of each style, and then one row for each kind of entry. Preview printed report shows how each style looks in the printed report.
- Style: the style of the entry. The list marks the default with (default).
- Default hide: new entries of this kind start hidden. Entries that already exist do not change. The Case Created entry is never hidden.
- Render Markdown: show the text as formatted Markdown. Clear it to show the text exactly as written.
By default, no kind of entry is hidden, and all kinds show Markdown except manual entries. Reset to defaults sets these values again. A settings export carries these settings to another installation.
Note: A hidden entry is not in the report or in the case data that the AI assistant reads. A new entry that starts hidden sends no webhook or email notification. Slack follows its own settings. Anyone who can edit the case can show a hidden entry again.
The timeline in reports
Investigation reports include the timeline as a generated section. It lists the visible timeline entries in chronological order. Each entry prints in the style it has on the timeline, and its text follows the Render Markdown setting. Entries for evidence step updates and for action note edits do not print. A note entry prints the names of its images, not the images.
An action's note prints once, in its current version, under the action's latest Action started or Action completed entry.
An entry that names a TLP:RED indicator, such as Indicator added, never appears in the report. To keep an entry out of the report, hide it on the timeline. To keep an action note out, hide the action's latest note entry, or hide the action's entry.
Working with a timeline
Maintaining Accuracy
- Use source timestamps: Always use the timestamp from the original source, not when you found it
- Note timezone: All times in DFIRe are displayed in UTC - convert timestamps accordingly
- Document uncertainty: If a timestamp is approximate, note it in the details field
Effective Timeline Building
- Start with known anchor points (incident start, detection time)
- Work forwards and backwards from anchor points
- Add manual entries for pre-case events as you discover them
- Hide routine events that add noise without value
Using Timeline for Analysis
- Identify patterns in attacker behavior
- Determine dwell time (time between compromise and detection)
- Reconstruct the attack chain
- Correlate events across multiple evidence sources