> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md).

# Investigation timeline

The Timeline page enables you to view the list of forensic artifacts that were tagged. The tags display details of the forensic data collected from the endpoints.

The Timeline table displays the following fields:

| Field                   | Description                                                                                                                                                   |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Hostname                | Name of the host machine.                                                                                                                                     |
| Timestamp               | Timestamp associated with the artifact.                                                                                                                       |
| Type                    | Forensic artifact of which a tag was added.                                                                                                                   |
| Description             | Name of the timestamp field.                                                                                                                                  |
| Tags                    | <p>There are three default tags to choose from.</p><ul><li>legitimate</li><li>malicious</li><li>suspicious</li></ul><p>You can also create your own tags.</p> |
| User                    | User account associated with the forensic artifact.                                                                                                           |
| Data                    | Data summary for the tagged item.                                                                                                                             |
| Mitre Att\&ck Tactic    | Displays the type of MITRE ATT\&CK tactic of the tagged item.                                                                                                 |
| Mitre Att\&ck Technique | Displays the type of MITRE ATT\&CK technique of the tagged item.                                                                                              |
| Notes                   | Displays notes entered by the user.                                                                                                                           |

1. Edit a timeline entry:

   You can edit a tag of an artifact in the Timeline table.

   1. Locate the relevant item to update the tag.
   2. Right-click and select Edit timeline entry.
   3. In Edit timeline entry, update the information as required and then click Save to update the changes.
2. Clear a timeline entry:

   You can remove a tag from the artifact in the Timeline table.

   1. Locate the relevant item to remove the tag.
   2. Right-click and select Clear timeline entry. The tag is removed from the artifact and the row is removed from the Timeline table.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/investigation-and-response/forensics/forensic-investigations/analysis-and-documentation/investigation-timeline.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.