Patent Document ID: 9516052
Application ID: 14815981
Patent Flag: 1

Claim One:
1. A method comprising: receiving a selection of one or more first events stored by a data intake and query system for inclusion in a timeline view, each first event of the one or more first events corresponding to a computer network security event; receiving a selection of one or more second events stored by the data intake and query system for inclusion in the timeline view, each second event of the one or more second events corresponding to one or more actions taken by a user to investigate a network security incident; generating the timeline view including a plurality of event identifiers, the plurality of event identifiers including (a) at least one first event identifier corresponding to an event from the first events, and (b) at least one second event identifier corresponding to an event from the second events; wherein each event identifier of the plurality of event identifiers is configured for display at a location on the timeline view based on a timestamp associated with a respective event; and causing display of the timeline view.