https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/view-general-forensic-timeline-for-endpoint/m-p/426566#M960 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/150738">@BenHooper</a>,</P><P>&nbsp;</P><P>You should be able to view the forensic timeline for an alert as opposed to an endpoint. That timeline can be accessed by right-clicking on an alert, hovering over "investigate Causality Chain," and selecting "open Timeline in new tab." See the image below for a highlight.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="gjenkins_1-1628787548814.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/35666i868839F608CB3F50/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="gjenkins_1-1628787548814.png" alt="gjenkins_1-1628787548814.png" /></span></P><P>&nbsp;</P> Thu, 12 Aug 2021 16:59:16 GMT gjenkins 2021-08-12T16:59:16Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/view-general-forensic-timeline-for-endpoint/m-p/351105#M330 <P>Is it possible to view the forensic timeline for an endpoint in general, not only for information that the system thinks is relevant to a specific incident?</P><P>&nbsp;</P><P>If not, can this be added?</P> Tue, 22 Sep 2020 14:58:58 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/view-general-forensic-timeline-for-endpoint/m-p/351105#M330 BenHooper 2020-09-22T14:58:58Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/view-general-forensic-timeline-for-endpoint/m-p/426566#M960 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/150738">@BenHooper</a>,</P><P>&nbsp;</P><P>You should be able to view the forensic timeline for an alert as opposed to an endpoint. That timeline can be accessed by right-clicking on an alert, hovering over "investigate Causality Chain," and selecting "open Timeline in new tab." See the image below for a highlight.</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="gjenkins_1-1628787548814.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/35666i868839F608CB3F50/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="gjenkins_1-1628787548814.png" alt="gjenkins_1-1628787548814.png" /></span></P><P>&nbsp;</P> Thu, 12 Aug 2021 16:59:16 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/view-general-forensic-timeline-for-endpoint/m-p/426566#M960 gjenkins 2021-08-12T16:59:16Z