Working with the Timeline report

The Timeline report is both a report and an interactive page that displays event information for a single endpoint.

The Timeline report can display information about active and hidden events. From the interactive Timeline report, you can unhide events that were hidden by using the Hide Events button in the Security page. For more information see Hiding events.
  1. From the main page, click the Reports tab.
    The Reports page opens.
  2. If you are running the Timeline report for the first time, click Select group here and choose an endpoint.
  3. To change the endpoint of the report, click the ellipsis in the navigation pane that is associated with the Timeline report. Click Change Endpoints. The Select systems for the report window opens. Expand the groups to view individual endpoints. Click the button next to the endpoint for which you want to run the report. Click Save.
  4. You can control the events that are displayed in the report for the selected endpoint. In the upper right of the title bar you can view each of the event types that are included in the report. The event types include the following:
    • Agent Connectivity
    • Allow Listing
    • Blocklist
    • Configuration
    • Status Change
    • File Integrity Monitoring
    • Host Intrusion
    • Malware
    • Scheduled Command Failed
    • Patch Management

    Hover over one of the events and click the associated icon. A drop down menu opens. Click the event type to turn the display on or off.

  5. Use the Show hiddencontrol to display events that are hidden. From the Security page, you can hide events after you have fixed the issues causing the event. Click Show hidden to display the hidden events in the timeline. Clear Show hidden to hide the events.
  6. The events listed for the selected endpoint occurred within the time range specified in the From and To date fields. You can modify the dates to increase or decrease the time range. The list of events is automatically refreshed.
  7. The Month, Day, Hour, and Events in list fields control the number of rows that are included in the report. Listing the events by Month is the least granular listing, and listing the events by Hour is the most detailed listing.
  8. Events are highlighted in the table with a circle. A number within the circle indicates more than one event. Click on the circle to view the details of the event. For multiple events, PowerSC automatically refreshes the display to show each event. Click the event to view the details.
  9. From the Details page, you can unhide an event. To unhide an event, ensure that the Show hidden event check box is selected. Click on the hidden event. From the Details window, click Hide events.