@@ -233,7 +233,6 @@ The Cases page is used to open and track security issues directly in the
233233image::images/cases-ui-home.png[]
234234
235235[float]
236- [[timelines-ui]]
237236== Timelines
238237
239238Use Timeline as your workspace for alert investigations or threat hunting.
@@ -260,7 +259,6 @@ can also link to timelines from Cases and external ticketing systems.
260259
261260
262261[discrete]
263- [[raw]]
264262==== Focus on signals or raw events
265263
266264Many security events in Timeline are presented in an easy-to-follow rendered
@@ -272,7 +270,6 @@ You can click and expand events from within Timeline to see the underlying
272270event data, either in tabular form, as as {es} JSON.
273271
274272[discrete]
275- [[narrow-expand]]
276273==== Narrow or expand your query
277274
278275You can specify logical `AND` and `OR` operations with an item's placement in
@@ -281,7 +278,6 @@ sets are `OR`-ed together. As you hover the item over the drop area, you can see
281278whether your placement is on target to create an `AND` or `OR` filters.
282279
283280[discrete]
284- [[pivot]]
285281==== Pivot on a data point
286282
287283Click a filter to access additional operations such as exclude, temporarily
@@ -290,7 +286,6 @@ item so that it is excluded.
290286
291287[discrete]
292288[[row-renderer]]
293- ==== Get more context for each event
294289
295290As you build and modify your queries, you can see the results of your
296291interactions in the details pane below.
@@ -301,7 +296,6 @@ event. If you see a particular item that interests you, you can drag it to the
301296drop area for further introspection.
302297
303298[discrete]
304- [[import-export-timelines]]
305299==== Export and import timelines
306300
307301You can import and export timelines, which enables importing timelines from one
@@ -320,7 +314,6 @@ then select _Export selected_.
320314the timeline `ndjson` file.
321315
322316[discrete]
323- [[other]]
324317==== Other actions
325318
326319The Timeline is flexible and highly interactive. As you would expect, the
0 commit comments