By creating a single Event Filter, you can tell the story of what happened during your incident: how it started, who helped, any remediation steps, etc.. Include all the tags you used in the first step of your investigation. A timeline can be created from the current event data by clicking Build a timeline. The number on the button tells you the number of events that will be in the timeline.

• Create a filter: In the Filtered By box, select the names of the desired tags. In the Select or Create a Filter box, type the name of your filter (e.g., Event) to create and save your filter.
• Build the snake timeline: After you’ve selected your filters, click Build a Timeline to display the messages on a timeline. You can change the data in the timeline by searching or filtering.

Example Timeline:

What's the Difference Between Narrative Builder and the Snake Timeline?

The snake timeline can be used to get a sense of events and where each event falls related to each other on a time scale perspective. The snake timeline view gives you the ability to look at all events together, rather than picking and choosing, like you can with Narrative Builder.

The snake timeline allows you to visualize key elements of the situation like "what time did each responder join?" or "gaps in communication."