Viewing Pinned Timeline Events

Elastic Security SIEM
1

Is it possible to only view events which have been pinned (marked as persisted with the timeline)?

2

We appreciate your feedback Travis, and agree that providing a toggle or view in the Timeline to only show pinned events would be especially useful when (only) the pinned events are necessary to tell the story, and when pinned events span multiple pages of search results.

We created the following Github issue to track this feature request: https://github.com/elastic/kibana/issues/49288

As a workaround, after pinning events, consider narrowing the Timeline's search criteria to only / mostly include pinned events, via one or more of the following techniques:

  • Add additional filters. For example, expand the pinned events, and drag / drop the (pinned) event _id values
  • Narrow the search via KQL using the event _id s, or any criteria that only matches the pinned events
  • Narrow the date range
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.