> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md).

# Configure the indicator timeline

Configure the indicator timeline in Cortex XSOAR 8.10 On-prem.

To effectively investigate an incident and analyze associated indicators, the SOC analyst must have access to up-to-date data and a clear view of the most recent changes made to the relevant indicators, as well as earlier entries of indicator changes. The indicator timeline provides access to recent and earlier indicator activity data, facilitating quicker threat detection and response actions.

{% hint style="info" %}

### Note

You must have the Cortex XSOAR Threat Intel Management (TIM) license to access the indicator timeline.
{% endhint %}

**Enable or disable the indicator timeline**

You can configure server configurations to disable the indicator timeline display or disable indicator extraction to the indicator timeline.

1. Select Settings & Info → Settings → System → **Server Settings** → **Server Configuration** → **Add Server Configuration**.
2. Add the following server configurations.

   | Key                                           | Value                     | Description                                                                                                    |
   | --------------------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------- |
   | **`indicator.timeline.enabled`**              | **`true`** or **`false`** | Enables the indicator timeline to be displayed in the **Indicator Summary** layout. The default is **`true`**. |
   | **`indicator.timeline.auto.extract.enabled`** | **`true`** or **`false`** | Enables extracting indicator data to display in the indicator timeline. The default is **`true`**.             |

**View indicator timeline entries**

To see the indicator timeline entries, from the **Threat Intel** page select an indicator to go to the **Indicator Summary** page. If it does not contain the indicator timeline, you can edit the indicator layout and add the **Timeline** section.

By default, the indicator timeline table displays dates, events, and sources that affect indicators, such as change of verdict and traffic light protocol. Click ![cog-wheel-8.png](https://4220554293-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FM6t3x619iLxkOSWNFxz0%2Fuploads%2Fgit-blob-6df68b781763ec950ca6d64db216e9450134e9bb%2F67ac903e638b9199f1f6a0b9002d0344af5beeefae5b46e9aa51ebfdcc468e28.png?alt=media) to edit the table settings to also display category and indicator ID, or to search the table columns.

The indicator timeline contains two tabs:

* **Latest events**: Shows a table listing the most recent indicator timeline entries. This ensures continuous monitoring of security threats and provides access to the latest activity data.
* **Initial events**: Shows a table listing the first indicator timeline entries.

The maximum number of entries the tabs display is by default 100. The first 100 entries are displayed in both tabs. If there are more than 100 entries, the **Initial events** table displays the first 100 entries, and the **Latest events** table displays the 100 latest entries. For example, if there are 105 entries, the **Latest** table displays the five latest entries plus the 95 entries that occurred chronologically before them.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.10/investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.