Incident Timeline: Visual Activity History

The Incident Timeline provides a visual, chronological view of a student's online activity around a safety incident. Instead of scrolling through raw activity logs, the Incident Timeline presents a clear narrative of what happened before, during, and after a concerning event.

Before You Begin

• You need Admin, Counselor, or Safety Officer role
• Incident Timelines are generated automatically when a KyberPulse alert triggers
• You can also create custom timelines for any student and time period

What the Incident Timeline Shows

The timeline is a visual display that includes:

• Time axis — horizontal timeline spanning the selected period (typically 2 hours before and after an incident)
• Web activity — each website visit shown as a node on the timeline
• Color coding:
  • 🔴 Red — The triggering safety alert
  • 🟠 Orange — Related concerning activity
  • 🟡 Yellow — Potentially related activity
  • ⚪ Gray — Normal activity
• Search queries — highlighted separately to show what the student was searching for
• AI conversations — any AI chat activity during the period
• Screen captures — if Screen View was active, thumbnails from around the incident

Accessing an Incident Timeline

From a KyberPulse Alert

1. Open the KyberPulse alert
2. Click "View Incident Timeline"
3. The timeline automatically centers on the triggering event

Creating a Custom Timeline

1. Navigate to Reports → Incident Timeline
2. Select a student or device
3. Set the date and time range
4. Click "Generate Timeline"
5. The timeline loads with all activity during that period

Reading the Timeline

Zooming and Navigation

• Scroll to move forward and backward in time
• Pinch/zoom to expand or compress the time scale
• Click any node to see full details (URL, category, duration, screenshot)
• Hover over a node for a quick preview

Activity Clusters

The timeline automatically groups rapid activity into clusters. For example, if a student visited 20 sites in 5 minutes, the timeline shows a cluster with the count, expandable to see individual entries.

Context Markers

The timeline also shows:

• Class schedule — shaded bands showing when the student was in class
• Policy changes — markers where filtering policies changed (e.g., teacher activated Focus Mode)
• Device events — login/logout, device lock, network changes

Using Timelines for Documentation

Incident Timelines are valuable for:

1. Safety team meetings — visual aid for discussing incidents
2. Parent conferences — clear, chronological evidence
3. Compliance documentation — exportable record of incident investigation
4. Counselor referrals — context for understanding student behavior

Exporting a Timeline

1. Click "Export" at the top of the timeline
2. Choose format:
   • PDF — visual timeline with all details, suitable for printing
   • CSV — raw data for further analysis
3. Add optional notes to include in the export
4. Click "Download"

Tips

• Look at what happened BEFORE the alert — the activity leading up to a concerning event often provides important context
• Check multiple days — if a student shows concerning behavior, generate timelines for the past several days to identify patterns
• Use with Risk Scoring — combine timeline analysis with the student's risk profile for a complete picture
• Save important timelines — bookmark or export timelines you may need for future reference

Troubleshooting

• Timeline shows gaps? The device may have been offline or on a network that doesn't route through the proxy
• No screen captures? Screen View must have been active during the incident period. Historical screenshots are only available if they were captured in real-time
• Timeline won't load? Try narrowing the date range. Very long time periods with high activity may take time to generate

Related Articles

• KyberPulse: Real-Time Safety Alerts
• Student Risk Scoring
• Understanding Activity Logs