> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/detect-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md).

# Configure the indicator timeline

To effectively investigate an incident and analyze associated indicators, the SOC analyst must have access to up-to-date data and a clear view of the most recent changes made to the relevant indicators, as well as earlier entries of indicator changes. The indicator timeline provides access to recent and earlier indicator activity data, facilitating quicker threat detection and response actions.

{% hint style="info" %}

### Note

You must have the Cortex XSOAR Threat Intel Management (TIM) license to access the indicator timeline.
{% endhint %}

**Enable or disable the indicator timeline**

You can configure server configurations to disable the indicator timeline display or disable indicator extraction to the indicator timeline.

1. Select Settings & Info → Settings → System → **Server Settings** → **Server Configuration** → **Add Server Configuration**.
2. Add the following server configurations.

   | Key                                           | Value                     | Description                                                                                                    |
   | --------------------------------------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------- |
   | **`indicator.timeline.enabled`**              | **`true`** or **`false`** | Enables the indicator timeline to be displayed in the **Indicator Summary** layout. The default is **`true`**. |
   | **`indicator.timeline.auto.extract.enabled`** | **`true`** or **`false`** | Enables extracting indicator data to display in the indicator timeline. The default is **`true`**.             |

**View indicator timeline entries**

To see the indicator timeline entries, from the **Threat Intel** page select an indicator to go to the **Indicator Summary** page. If it does not contain the indicator timeline, you can edit the indicator layout and add the **Timeline** section.

By default, the indicator timeline table displays dates, events, and sources that affect indicators, such as change of verdict and traffic light protocol. Click ![cog-wheel-8.png](/files/ezDObiUUxTU09i2hi5Yt) to edit the table settings to also display category and indicator ID, or to search the table columns.

The indicator timeline contains two tabs:

* **Latest events**: Shows a table listing the most recent indicator timeline entries. This ensures continuous monitoring of security threats and provides access to the latest activity data.
* **Initial events**: Shows a table listing the first indicator timeline entries.

The maximum number of entries the tabs display is by default 100. The first 100 entries are displayed in both tabs. If there are more than 100 entries, the **Initial events** table displays the first 100 entries, and the **Latest events** table displays the 100 latest entries. For example, if there are 105 entries, the **Latest** table displays the five latest entries plus the 95 entries that occurred chronologically before them.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.8/detect-and-respond-to-threats/threat-intel-management/indicator-configuration/configure-the-indicator-timeline.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.