Behavior Timeline
The behavior timeline is the chronological event view for an entity under investigation: each instance where a behavior rule was triggered, with its score and the fields it recorded.
- v2 interface
- Classic v1 interface
In the navigation rail, open Notable Events (/v2/notable-events), subtitled Faceted search across notable behavior events. It lists the instances where behavior rules were triggered: one row per notable event. Whether a rule's events appear here is part of the rule's definition, set when the behavior rule is created.
The search bar carries a full-width search field, matched across all fields (Search across all fields – an IP, a user, a behavior rule…); the time-range buttons 1D (the default), 3D, 7D, 30D, 90D, ALL, and Custom, which adds a start and an end date; and Search. Searches are combined with the selected time range and any filter selections.
The FILTERS panel on the left can be used to filter events. It has six groups: Score Level, Entity / Key, Entity / Key Type, Behavior Rule, Behavior, and Risks, each with the number of values found in parentheses and a checkbox per value. The Facet Section covers the panel in detail.
The results table shows, by default, each event's Time, Entity / Key, Behavior Rule, Behavior, Score, and Level; ⚙ Columns adds Key Type, Score Level, Risks, and Customer. JSON line, on when the page opens, adds each event's JSON beneath its row. When nothing matches, the table reads No notable events match this filter.
Click an event to open its detail panel: the entity and the behavior rule, with the event's severity; a Test Suppressions button, which tests the event against the current behavior filters; an Overview of the event (Entity / Key, Key Type, Behavior, Behavior Rule, Time, Risk Score, and Score Level); its Attributes, the fields the rule recorded; and its Alerts & history.
To work the case the event belongs to, open the entity's summary from Cases Search.
Sign in to your Fluency portal at https://<companyname>.app.ingext.io; see Fluency Web Interface for the URL formats.
Choose the Behavior Timeline option under the SIEM menu in the navigation bar.
The Behavior Timeline page (/SIEM/behaviorTimeline) displays instances where behavior models were triggered. When creating a behavior model, there is a checkbox to indicate whether an event should appear on the behavior timeline when triggered by the rule. The chart at the top of the page plots each event's risk score over the search window.
The header row carries the page title on the left and the time-range presets on the right: 1D (the default), 3D, 7D, 30D, 90D, and ALL TIME, followed by a full-width Search field with a Search button. Searches are combined with the selected time range and any facet selections.
The chart is headed Timeline Chart Timeline with the number of plotted events in parentheses. It plots one dot per event, with Risk Score on the vertical axis and time of day on the horizontal axis (labeled Time).
The facet on the left side can be used to filter events. There are six fields associated with a behavior rule that can be used for search filters: key, key type, behavior rule, behavior, score level and risks. The sidebar starts with a Total Records count, and each facet lists its values with the matching event count on the right; a checkbox in the minus state excludes the value, and by default the 0 score bucket is excluded so zero-score events stay hidden. The Facet Section covers the sidebar and its toolbar in detail.
Below the chart, events are listed newest first along a vertical timeline, grouped by timestamp: a group can hold more than one card when several events share a timestamp. Each card shows the entity involved (username), the Behavior rule the event matched, the Score with a severity chip such as low, and an ellipsis (...) menu button in its upper-right corner.
Every entry has a pair of toggle buttons on the right edge of its lower panel. Alerts, the default view, shows tag chips for the alerts and risk tags the event raised (for example a red ALERT_POLICY chip). Attributes replaces the tags with the event's attribute fields as labeled rows; the fields depend on the event source, an Azure AD sign-in event showing ActorIP, AuthType, BrowserType, City, ClientIP, Country, and the like.
The ... menu on a card holds one option, View JSON.
View JSON opens a dialog of the same name showing the full event record as color-coded JSON: event fields such as sequence, timestamp, key, keyType, description, behaviorRule, behavior, riskScore, uuid, and ruleDescription; an AttributeMap object holding the same attribute fields the Attributes panel lists; and an attributes array pairing each raw source field with its alias and value. The X at the right end of the title bar closes the dialog.
The interactions described from here on (the magnifying-glass pivot to Events Search, the expandable risks table, and the Actions / FPL Actions buttons) and their screenshots belong to the legacy interface. On the v1 SIEM → Behavior Timeline page, each event is a card with a View JSON row menu and Alerts / Attributes toggle buttons.
Clicking on the magnifying glass icon of each record redirects you to the Events Search page (Data Lake → Search) and conducts a search using the name of the behavior alert and the alert's key as the search parameters. Refer to Investigating a Behavior Alert to see what you can do on the Events Search page.
In the figure below, the first value in the header is the name of the behavior model that triggered the alert. Beside this is the behavior type. In the middle of the header, the key is displayed (in this case, it's "asset"), followed by the score associated with the alert. Below this are the risks that were triggered, in addition to their descriptions and values (click the table to expand). Clicking the blue icon in the corner of the table opens the JSON data associated with the event.
Click the "Actions" button to open a menu with options for configuring different actions for this alert. Actions allow a user to set up a method of notification when certain alerts or behaviors are triggered. Clicking one of these options will redirect you to a configuration page for the indicated action option.
To the right of the "Actions" button, there's also a "FPL Actions". At present, there's only one action named "SentinelOneClassify".