Related events often occur in close time proximity. TimeWrinkle allows you to search a period of time around an event to see if related alerts or events were detected.
To use TimeWrinkle:
On the search results page, locate the event of interest.
In the meta_ts column, click
.png "HelixConnect_down-arrow.png")
and enter the period of time to search. The time range is added to the date and time range under the search box.Click Search. The updated results show only those events that fall within the time range you specified.
Tip
You can also use TimeWrinkle on the First seen and Last seen fields on the Summary tab when you open an alert from the alert table.