Skip to main content
Version: 2.9.X

Link Analysis Over Time

Linkage events with an Occurred at field can be compiled over a time and examined in one of two ways:

  • Timebar controls the period of time to examine link analysis. It is useful for illustrating changes over time.
  • Kronograph is an alternative way of visualizing a network's activity over time.

The time bar's primary function is to visualize entities and linkages as they occurred within a given time range.

To activate the time bar:

  1. At the top right of the link analysis widget, click the Time Bar icon. A time bar opens at the bottom of the screen.
  2. Examine the time bar as needed.
  3. Click the Time Bar icon to dismiss the time bar and return the link analysis widget to its default state.

Time Bar Controls​

The time bar's controls only respond when the cursor is placed within the time bar:

  • Hover over the time bar and scroll up or down with the middle mouse wheel to zoom in or out of the time window width. Zoom out for a higher-level view of the timeline, and zoom in to see finite time periods.
  • From the left or right end of the time bar, click and drag the two vertical bars to manually shorten or extend the time range.
  • From the left side of the time bar, click the Play (▶) to play an animation that simulates moving through the timeline. Scroll the mouse wheel up or down to zoom out or in and control the speed of the timeline animation.
  • To the right of the Play button, click Reset Time to include the entire range of time.

Viewing Pattern of Life via Kronograph​

The Kronograph view of Link Analysis is automatically generated by the link chart that is currently displayed in the widget. The Kronograph is an alternative way to visualize the network in a time-based view that seeks to help identify any patterns of life between entities.

The Kronograph view plots entities on the left side and linkage events as lines connecting entities. Linkage events can appear on the left bar as well.

To activate Kronograph view:

  1. From an open view at the upper right of an open Link Analysis widget, locate the Kronograph icon.
  2. Click the Kronograph icon to activate the Kronograph view.
  3. Inspect the Kronograph view as necessary. For more information, see Controlling Kronograph.
  4. Click the Kronograph icon to deactivate the Kronograph view.

Controlling Kronograph​

Kronograph controls involve zooming in or out of the timeline, isolating entries, and pinning entries of interest for further inspects.

To manipulate the timeline:

  • Scroll up to zoom out in the timeline and increase the time period.
  • Scroll down to zoom into the timeline and find more specific time periods.

The timeline condenses or expands along with the display of linkages as time changes.

To isolate an entity:

  1. Hover the mouse over any entity on the left of the Kronograph view. A target icon appears.
  2. Click the target icon to isolate the entity and show any entities linked to it.
  3. Click the target icon again to stop isolating the entity.

To pin an entity:

  1. Hover the mouse over any entity on the left of the Kronograph view. A pin icon appears.
  2. Click the pin icon to ensure it remains displayed regardless of timeframe or if any other entities are isolated.
  3. Click the pin icon again to unpin the entity.