0

I am trying to show a series of events from different platforms in a timeline graph to establish the activity of an object (login events, alerts etc.) across various security tools. Say I was looking back for the activity of an URL across different security tools. I can pull in events that will give me a timestamp of any event that has context about the URL.

A few scenarios that the timeline graph won't work (or for a few results/events):

  1. Any real-time lookup, such as VirusTotal lookups for a URL, doesn't actually fit into the activity of an incident, but rather is context gathered in real-time.
  2. There will always be certain events that will not have a timestamp to organize them in a timeline graph.

One solution is to add the real-time timestamp to these and display them in the timeline graph along with events that have an actual timestamp.

Any recommendations? Is it misleading?

Improve this question
3
  • is it correct to assume this some custom report or ui you're developing? or are you already using some pre-existing time-series analysis tool? (depending on your needs, your analysis work is after the fact, so those events would be shown when they actually happened, eg. "on the right on the timeline" - then you would typically compress time where no events happen to reduce the width .. the elapsed time of the gap is interesting also)
    – brynk
    Jun 22, 2022 at 23:26
  • Yes your assumption is correct ! Its a custom UI that I am developing. Thanks for the input, I did not quite catch the compress time and elapsed time part of your note !
    – peanutlife
    Jun 23, 2022 at 13:24
  • (for example) if the timeline is on the x-axis then you could plot your analysis events on the same timeline (or start a new one), but these all happen after the incident, either way there would be a portion of time with no events occurring - the delay is how long it takes your systems/ op-centre to recognise the problem/ start investigating
    – brynk
    Jun 23, 2022 at 20:21

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .