Timeline - DFIRe documentation

What the timeline holds

The timeline records what happened to a case. DFIRe writes most of it for you, and you add what it could not see: the events your analysis uncovered.

Entries group by date and carry UTC timestamps. A Case Opened separator divides what happened before the case existed from what happened during it, which is what makes a backdated entry read correctly.

What DFIRe records for you

DFIRe automatically logs these events to the timeline:

Event Type	Description
Case lifecycle
Case Created	Someone opened the case.
Case Closed	Someone closed it.
Case Reopened	Someone reopened it.
Case Archived	Someone archived it, which locks it against every edit.
Escalated to Incident	An investigation became an incident.
Severity Changed	Severity moved, recording the old and the new value.
Lead Investigator Changed	The lead investigator changed, arrived or left.
Incident Phase Changed	The incident moved to another phase.
Playbook Changed	The case moved to a different playbook.
Evidence
Evidence Added	New evidence item added to the case
Evidence Step Updated	Evidence item's processing step changed (e.g. Acquisition → Analysis)
Custody Transfer	Chain-of-custody transfer recorded on an evidence item
Case File Added	Attachment uploaded to the case
Evidence File Added	Attachment uploaded to an evidence item
Notes & actions
Case Note	Note added to the case
Evidence Note	Note pinned to an evidence item
Action Started	An action was taken (assigned and moved to Started)
Action Completed	Someone completed an action.
Action Details Updated	Someone edited an action's description or details.
Action Note Updated	Someone wrote or changed an action's note.
CAN Report Updated	A new version of the CAN report exists.
Compliance timers
Compliance Timer Started	Someone started a compliance timer.
Compliance Timer Warning	A timer passed a warning threshold, at 50%, 25% and 10% remaining.
Compliance Timer Breached	A timer passed its deadline unfinished.
Compliance Timer Completed	Someone completed a timer.
Indicators
Indicator Added	An indicator joined the case.
Indicator Classification Changed	An indicator's classification changed.
Manual entries
Manual Entry	Someone added an entry by hand, optionally backdated.

DFIRe records these wherever the change came from: the case screen, Slack, an automation rule or the API. Each event names the person who made the change. Changes made by an automation rule are attributed to Automation, and events with no originating user show as System.

Adding an entry yourself

Add Entry on the Timeline tab records something DFIRe could not observe. Give it a subject, optional detail, and the time it actually happened, in UTC. Choose Event happened now for something current, or set a past date to place it correctly in the sequence.

Tick Adversary activity when the entry records something the attacker did. The timeline shows those entries in red, and the Adversary Activity filter narrows the list to them. Edit the entry later to set or clear the flag.

Tip: Use manual entries to document events that happened before the case was opened, such as initial malware detection, first sighting dates, or compilation timestamps.

Bulk import: Timeline events can also be imported in bulk from a CSV file via the Import button on the Timeline tab. A preview step shows which rows will be created or updated before anything is written.

Hiding an event

Noise can be hidden rather than deleted. Edit an event and turn on Hidden from timeline. The event stays in the record and comes back whenever you want it.

Seeing what is hidden

The hidden button in the toolbar shows how many events are hidden and brings them back into view, tagged and struck through so you can tell them apart.

Note: Case Created and Phase Changed events cannot be edited, as they record what the case itself did. Phase changes can still be hidden from the report; the Case Created event cannot.

Filtering and sorting

The timeline toolbar provides several options to focus on specific events:

Event Type Filter

Use the "All Events" dropdown to filter by specific event types:

Manual Entries
Adversary Activity
Phase Changes
Severity Changes / Lead Changes
Actions Started / Actions Completed
Evidence Added / Step Changes
Case Files / Evidence Files
Case Notes / Evidence Notes

Sort Order

Click the sort button to toggle between:

Newest First: Most recent events at the top (default)
Oldest First: Earliest events at the top

Incident phases

For incident cases, the timeline integrates with incident phases:

Phase indicator: Each event shows the incident phase when it occurred
Phase changes: Phase transitions are highlighted as prominent events
Change phase: Click the current phase in the toolbar to change to a different phase

Phase changes create timeline events automatically, documenting when the incident moved between phases and who made the change.

The timeline in reports

The timeline is automatically included in investigation reports as a generated section. All visible timeline events (excluding hidden ones) are rendered chronologically in the report output.

To exclude specific events from reports, hide them from the timeline before generating the report.

Working with a timeline

Maintaining Accuracy

Use source timestamps: Always use the timestamp from the original source, not when you found it
Note timezone: All times in DFIRe are displayed in UTC - convert timestamps accordingly
Document uncertainty: If a timestamp is approximate, note it in the details field

Effective Timeline Building

Start with known anchor points (incident start, detection time)
Work forwards and backwards from anchor points
Add manual entries for pre-case events as you discover them
Hide routine events that add noise without value

Using Timeline for Analysis

Identify patterns in attacker behavior
Determine dwell time (time between compromise and detection)
Reconstruct the attack chain
Correlate events across multiple evidence sources