Building the Narrative
Lesleanne Blakeley avatar
Written by Lesleanne Blakeley
Updated over a week ago

Building the Narrative

Clicking “Edit narrative” takes you into the Builder view. This will be your main workspace as you identify events from an incident that you want to mark in your timeline.

The window is split into two side by side screens with the channels imported from Slack, the opportunity data to the left, and your working narrative timeline of event markers to the right.

Think of the opportunity data as your pile of puzzle pieces, and the narrative timeline as where you piece them together to form the bigger picture of the incident.

Opportunity Data contains the message logs from the channels you imported from Slack with ways to search and filter to help you find the messages that marked different events throughout the incident.

Narrative Timeline is where you will create and flesh out the event markers, adding summaries, notes and pulling in supporting evidence from messages you find in Opportunity Data. The event markers you create build out the story of the incident and make up the visual timeline you see at the top of the presentation view.

📣 Visit our Basic Investigation Tutorial to learn how to build your first Narrative!

Did this answer your question?