---
title: Adding Timeline Events to the Canvas
description: Add timeline events to the investigation canvas by adding the related entities to the canvas.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/threat-intelligence-security-center/tisc-add-timeline-events.html
release: australia
product: Threat Intelligence Security Center
classification: threat-intelligence-security-center
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 1
breadcrumb: [Using Timeline in Investigation Canvas, Working with Investigation Canvas, Threat Analyst Workbench, Use, Threat Intelligence Security Center, Security Operations]
---

# Adding Timeline Events to the Canvas

Add timeline events to the investigation canvas by adding the related entities to the canvas.

## Before you begin

Role required: sn\_sec\_tisc.analyst

## Procedure

1.  Navigate to **Workspaces** > **Threat Intelligence Security Center**.

2.  Select the **Threat Analyst Workbench** icon.

3.  Go to **Investigation Canvases** > **All Canvases**.

4.  Select any canvas record.

5.  Go to **Investigation Canvas** section on the selected canvas record.

6.  Right click the desired node on the canvas, select **Edit Timeline Event\(s\)**.

    The Edit Timeline Event\(s\) dialog box displays.

    \[Omitted image "tisc-add-timeline-event01.png"\] Alt text: Edit timeline event\[Omitted image "tisc-add-timeline-event.png"\] Alt text: Add events to the timeline

7.  Select **Add Event** to add the custom timeline event.

8.  Select the **Event** and **Timestamp** of the event.

9.  Select **Save** to confirm your changes to add a timeline event to the selected investigation canvas.

    The event will be linked to the selected object and also include its timestamp. The visual presentation of the event including the icon and its color reflects the configuration defined during the setup.

    For information on how the timeline events are configured, see [Configure Custom Event Types for Timeline](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-config-timeline.md).


**Parent Topic:**[Using Timeline in Investigation Canvas](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/threat-intelligence-security-center/tisc-timeline-events.md)