I am trying to show a series of events from different platforms in a timeline graph to establish the activity of an object (login events, alerts etc.) across various security tools. Say I was looking back for the activity of an URL across different security tools. I can pull in events that will give me a timestamp of any event that has context about the URL.
A few scenarios that the timeline graph won't work (or for a few results/events):
- Any real-time lookup, such as VirusTotal lookups for a URL, doesn't actually fit into the activity of an incident, but rather is context gathered in real-time.
- There will always be certain events that will not have a timestamp to organize them in a timeline graph.
One solution is to add the real-time timestamp to these and display them in the timeline graph along with events that have an actual timestamp.
Any recommendations? Is it misleading?