Filter entities with the timebar#

Besides filtering entities and observables based on specific properties and attributes, you can also filter them by time range.

The graph time-bar allows filtering nodes on the graph based on the specified time interval.

For example, to examine how a threat scenario evolves over time, or to focus on a specific phase in the development of the scenario under investigation.

  1. In the Graph view, go to the top-right corner, and click clock icon to open the timebar.

    The time-bar is displayed at the bottom of the Graph view.

  2. Go to the top-left corner of the timebar and click the drop-down menu to set the time reference you want to use:

    • Start time: filters entities and observables on the graph based on the start time.

      (meta.estimated_threat_start_time in the corresponding JSON data schema).

    • Observed at: filters entities and observables on the graph based when they were observed.

      (meta.estimated_observed_time in the corresponding JSON data schema).

    • Ingested at: filters entities and observables on the graph based on the time when they are ingested in the platform.

      (meta.estimated_threat_start_time in the corresponding JSON data schema).

  3. Click and slide the timeline on the time-bar to the right or to the left to move it forward or backward on the timeline respectively.

In the displayed view you can:

  • Zoom in: to focus on a specific time with detail.

  • Zoom out: to focus on a more general overall view of the time range.

The bar chart on the timebar shows how the network displayed on the graph grows over time. Double click on the timebar to display smaller time ranges.