{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44395,"path":"security-management/security-incident-response/configure-timeline-events-sir.md","title":"Configure timeline event configurations","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure timeline event configurations\n\nCreate or modify timeline event configurations to control which events appear on the security incident timeline.\n\n## Before you begin\n\nRole required: sn\\_si.admin\n\n## Procedure\n\n1.  Navigate to **Workspaces** > **Security Incident Response Workspace** > **Administration**.\n\n2.  Select **Timeline Event Configuration**.\n\n3.  Select **New** to create a configuration, or open an existing one to modify it.\n\n4.  Fill in the event configuration fields.\n\n    |Field|Description|\n    |-----|-----------|\n    |Name|Name of the event as it appears on the timeline.|\n    |Description|A brief description of what this event type represents.|\n    |Active|When deselected, events of this type do not appear on the timeline.|\n    |Event Type|Select **Point** \\(single marker at a timestamp\\) or **Range** \\(bar spanning a start and end time\\).|\n    |Fetch Type|Select **Table** \\(query a table directly\\) or **Script** \\(use a custom script\\). The form fields change based on this selection.|\n    |Icon|Icon used to represent this event on the timeline.|\n    |Color|Color used to visually distinguish this event type from others.|\n\n    |Field|Description|\n    |-----|-----------|\n    |Source Table|Table from which to retrieve event data.|\n    |SIR Reference Field|Field on the source table that links records to a security incident.|\n    |Event Label Field|Field to display as the event label on the timeline.|\n    |Additional Filter|Filter conditions to restrict which records appear as events.|\n    |Timestamp Field|Date and time field for the position of a point event. Visible when Event Type is Point.|\n    |Start Date and Time Field|Date and time field marking the beginning of a range event. Visible when Event Type is Range.|\n    |End Date and Time Field|Date and time field marking the end of a range event. Visible when Event Type is Range.|\n\n    |Field|Description|\n    |-----|-----------|\n    |Script|Server-side script that fetches event data. The script field includes commented template code showing the expected format for both point and range events.|\n\n5.  Select **Save**.\n\n6.  Scroll down to the **Popover Fields** related list.\n\n7.  Select **New** to add a popover field.\n\n8.  Fill in the popover field details and select **Submit**.\n\n    |Field|Description|\n    |-----|-----------|\n    |Admin Event Configuration|The parent event configuration this popover field belongs to.|\n    |Source Table|Automatically populated from the event configuration. Read-only.|\n    |Field Name|The field whose value is displayed in the popover.|\n    |Label|Display label for this field in the popover.|\n    |Is Link|When selected, the field value appears as a clickable link to the related event record.|\n    |Order|Sort order in the popover. Lower values appear first.|\n\n    **Note:** For state transition events, the popover automatically displays the state, the previous state \\(from/to\\), and the duration. Color coding for each state is fixed and consistent across all timelines.\n\n\n**Parent Topic:**[Timeline in Security Incident Response Workspace](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/security-incident-response/timeline-sir-workspace.md)\n\n"}}