3. Behavior Timeline

The Behavior Timeline page displays instances where behavior rules were triggered. When creating a behavior rule, there is a checkbox to indicate whether an event should appear on the behavior timeline when triggered by the rule. The chart at the top of the page indicates the total RiskScore at any time over the search window.

Clicking on the magnifying glass icon of each record redirects you to the Events Search page (Data Lake -> Events Search) and conducts a search using the name of the behavior alert and the alert's key as the search parameters.